failproofai 1.0.4-beta.2 → 1.0.4-beta.6

package/.next/standalone/.next/static/chunks/{0wz8yftk18ts2.js → 3jxd133cw2vm3.js}

@@ -1 +1 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,30142,e=>{"use strict";var t=e.i(95187);let a=(0,t.createServerReference)("60d4b56a98077468792db89d8812f1e5e786583628",t.callServer,void 0,t.findSourceMapURL,"searchHookActivityAction");e.s(["searchHookActivityAction",0,a])},73520,e=>{"use strict";var t=e.i(43476),a=e.i(24071),r=e.i(67927);e.s(["default",0,function({currentPage:e,totalPages:s,onPageChange:i}){if(s<=1)return null;let l=e=>`px-3 py-2 text-sm rounded-md transition-colors flex items-center gap-1 bg-muted text-muted-foreground ${e?"opacity-50 cursor-not-allowed":"hover:bg-muted/80"}`;return(0,t.jsxs)("div",{className:"flex items-center justify-center gap-2 py-4",children:[(0,t.jsxs)("button",{onClick:()=>i(e-1),disabled:1===e,className:l(1===e),"aria-label":"Previous page",children:[(0,t.jsx)(a.ChevronLeft,{className:"w-4 h-4"}),(0,t.jsx)("span",{className:"hidden sm:inline",children:"Previous"})]}),(0,t.jsx)("div",{className:"flex items-center gap-1",children:(()=>{if(s<=7)return Array.from({length:s},(e,t)=>t+1);let t=[1],a=Math.max(2,e-1),r=Math.min(s-1,e+1);e<=3&&(r=Math.min(5,s-1)),e>=s-2&&(a=Math.max(2,s-4)),a>2&&t.push("ellipsis-start");for(let e=a;e<=r;e++)t.push(e);return r<s-1&&t.push("ellipsis-end"),t.push(s),t})().map(a=>"string"==typeof a?(0,t.jsx)("span",{className:"px-2 text-muted-foreground",children:"..."},a):(0,t.jsx)("button",{onClick:()=>i(a),className:`min-w-[2.5rem] px-3 py-2 text-sm rounded-md transition-colors ${e===a?"bg-primary text-primary-foreground":"bg-muted text-muted-foreground hover:bg-muted/80"}`,"aria-label":`Page ${a}`,"aria-current":e===a?"page":void 0,children:a},a))}),(0,t.jsxs)("button",{onClick:()=>i(e+1),disabled:e===s,className:l(e===s),"aria-label":"Next page",children:[(0,t.jsx)("span",{className:"hidden sm:inline",children:"Next"}),(0,t.jsx)(r.ChevronRight,{className:"w-4 h-4"})]})]})}])},34713,e=>{"use strict";e.s(["formatDuration",0,function(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let a=Math.round(e/1e3);if(a<3600){let e=Math.floor(a/60);return`${e}m ${a%60}s`}let r=Math.round(e/6e4),s=Math.floor(r/60);return`${s}h ${r%60}m`},"formatRelativeTime",0,function(e){let t=Date.now()-e;return t<6e4?`${Math.max(1,Math.floor(t/1e3))}s ago`:t<36e5?`${Math.floor(t/6e4)}m ago`:t<864e5?`${Math.floor(t/36e5)}h ago`:`${Math.floor(t/864e5)}d ago`}])},24071,e=>{"use strict";let t=(0,e.i(56420).default)("chevron-left",[["path",{d:"m15 18-6-6 6-6",key:"1wnfg3"}]]);e.s(["ChevronLeft",0,t],24071)},67927,e=>{"use strict";let t=(0,e.i(56420).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["ChevronRight",0,t],67927)},16306,e=>{"use strict";let t=(0,e.i(56420).default)("shield-alert",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]]);e.s(["ShieldAlert",0,t],16306)},84026,29407,e=>{"use strict";var t=e.i(56420);let a=(0,t.default)("shield-check",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]]);e.s(["ShieldCheck",0,a],84026);let r=(0,t.default)("shield-x",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m14.5 9.5-5 5",key:"17q4r4"}],["path",{d:"m9.5 9.5 5 5",key:"18nt4w"}]]);e.s(["ShieldX",0,r],29407)},82954,e=>{"use strict";let t=(0,e.i(56420).default)("shield",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]]);e.s(["Shield",0,t],82954)}]);
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,44649,e=>{"use strict";var t=e.i(95187);let a=(0,t.createServerReference)("6009779268cbebb950fffbef0f7dab73fe58ddbf3b",t.callServer,void 0,t.findSourceMapURL,"searchHookActivityAction");e.s(["searchHookActivityAction",0,a])},73520,e=>{"use strict";var t=e.i(43476),a=e.i(24071),r=e.i(67927);e.s(["default",0,function({currentPage:e,totalPages:s,onPageChange:i}){if(s<=1)return null;let l=e=>`px-3 py-2 text-sm rounded-md transition-colors flex items-center gap-1 bg-muted text-muted-foreground ${e?"opacity-50 cursor-not-allowed":"hover:bg-muted/80"}`;return(0,t.jsxs)("div",{className:"flex items-center justify-center gap-2 py-4",children:[(0,t.jsxs)("button",{onClick:()=>i(e-1),disabled:1===e,className:l(1===e),"aria-label":"Previous page",children:[(0,t.jsx)(a.ChevronLeft,{className:"w-4 h-4"}),(0,t.jsx)("span",{className:"hidden sm:inline",children:"Previous"})]}),(0,t.jsx)("div",{className:"flex items-center gap-1",children:(()=>{if(s<=7)return Array.from({length:s},(e,t)=>t+1);let t=[1],a=Math.max(2,e-1),r=Math.min(s-1,e+1);e<=3&&(r=Math.min(5,s-1)),e>=s-2&&(a=Math.max(2,s-4)),a>2&&t.push("ellipsis-start");for(let e=a;e<=r;e++)t.push(e);return r<s-1&&t.push("ellipsis-end"),t.push(s),t})().map(a=>"string"==typeof a?(0,t.jsx)("span",{className:"px-2 text-muted-foreground",children:"..."},a):(0,t.jsx)("button",{onClick:()=>i(a),className:`min-w-[2.5rem] px-3 py-2 text-sm rounded-md transition-colors ${e===a?"bg-primary text-primary-foreground":"bg-muted text-muted-foreground hover:bg-muted/80"}`,"aria-label":`Page ${a}`,"aria-current":e===a?"page":void 0,children:a},a))}),(0,t.jsxs)("button",{onClick:()=>i(e+1),disabled:e===s,className:l(e===s),"aria-label":"Next page",children:[(0,t.jsx)("span",{className:"hidden sm:inline",children:"Next"}),(0,t.jsx)(r.ChevronRight,{className:"w-4 h-4"})]})]})}])},34713,e=>{"use strict";e.s(["formatDuration",0,function(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let a=Math.round(e/1e3);if(a<3600){let e=Math.floor(a/60);return`${e}m ${a%60}s`}let r=Math.round(e/6e4),s=Math.floor(r/60);return`${s}h ${r%60}m`},"formatRelativeTime",0,function(e){let t=Date.now()-e;return t<6e4?`${Math.max(1,Math.floor(t/1e3))}s ago`:t<36e5?`${Math.floor(t/6e4)}m ago`:t<864e5?`${Math.floor(t/36e5)}h ago`:`${Math.floor(t/864e5)}d ago`}])},24071,e=>{"use strict";let t=(0,e.i(56420).default)("chevron-left",[["path",{d:"m15 18-6-6 6-6",key:"1wnfg3"}]]);e.s(["ChevronLeft",0,t],24071)},67927,e=>{"use strict";let t=(0,e.i(56420).default)("chevron-right",[["path",{d:"m9 18 6-6-6-6",key:"mthhwq"}]]);e.s(["ChevronRight",0,t],67927)},16306,e=>{"use strict";let t=(0,e.i(56420).default)("shield-alert",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]]);e.s(["ShieldAlert",0,t],16306)},84026,29407,e=>{"use strict";var t=e.i(56420);let a=(0,t.default)("shield-check",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m9 12 2 2 4-4",key:"dzmm74"}]]);e.s(["ShieldCheck",0,a],84026);let r=(0,t.default)("shield-x",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"m14.5 9.5-5 5",key:"17q4r4"}],["path",{d:"m9.5 9.5 5 5",key:"18nt4w"}]]);e.s(["ShieldX",0,r],29407)},82954,e=>{"use strict";let t=(0,e.i(56420).default)("shield",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}]]);e.s(["Shield",0,t],82954)}]);

package/.next/standalone/.next/static/chunks/44ncu88eq6z71.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,24358,e=>{"use strict";var s=e.i(43476),a=e.i(71645),n=e.i(95187);let t=(0,n.createServerReference)("009ad545620d7158fc4c18ddc9854cfa5473399e64",n.callServer,void 0,n.findSourceMapURL,"getAuditResultAction");var r=e.i(12344);function i({cachedAt:e,fixed:a=!1}){return(0,s.jsxs)("footer",{className:a?"report-footer report-footer--fixed":"report-footer",children:[(0,s.jsx)("img",{src:"/logo.svg",alt:"failproof_ai",style:{height:18,display:"inline-block",verticalAlign:"middle"}}),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"audit v1.0",(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"generated ",function(e){if(!e)return"—";let s=new Date(e);if(Number.isNaN(s.getTime()))return"—";let a=s.getUTCDate().toString().padStart(2,"0"),n=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"][s.getUTCMonth()],t=s.getUTCFullYear(),r=s.getUTCHours().toString().padStart(2,"0"),i=s.getUTCMinutes().toString().padStart(2,"0");return`${a} ${n} ${t}, ${r}:${i} utc`}(e),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),(0,s.jsx)("span",{style:{color:"var(--ink-2)"},children:"auto-healing for your agents."})]})}let l=(0,n.createServerReference)("40627fe0bb35d1aea2f59f4ed5f39912b524a8cc1c",n.callServer,void 0,n.findSourceMapURL,"dismissLeakAction"),c=(0,n.createServerReference)("004c0a92f30b3875d89d14068f7fbdb7ecce772dc3",n.callServer,void 0,n.findSourceMapURL,"getLeaksAction"),d=(0,n.createServerReference)("40dbb536ad33353d440386d51c0242e56cd808cfbc",n.callServer,void 0,n.findSourceMapURL,"setLeakNotifyAction");function o(e){let s=Date.parse(e);if(!Number.isFinite(s))return"unknown";let a=Math.floor((Date.now()-s)/864e5);return a<=0?"today":1===a?"yesterday":a<30?`${a}d ago`:new Date(s).toLocaleDateString(void 0,{month:"short",day:"numeric"})}function u(){let[e,n]=(0,a.useState)(null),[t,r]=(0,a.useState)(!0),[i,u]=(0,a.useState)(null),h=(0,a.useCallback)(async()=>{let e=await c();n(e.rows),r(e.notify)},[]);(0,a.useEffect)(()=>{h()},[h]);let p=(0,a.useCallback)(async e=>{u(e);try{await l(e)&&n(s=>s?.filter(s=>s.id!==e)??null)}finally{u(null)}},[]),m=(0,a.useCallback)(async()=>{let e=!t;r(e),await d(e)||r(!e)},[t]);return null===e?null:(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"02 Leaks",children:[(0,s.jsxs)("div",{className:"audit-sec-head",children:[(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"02"}),"// credentials"]}),(0,s.jsx)("button",{type:"button",className:"cbb-toggle leak-notify","data-on":t,onClick:m,"aria-label":t?"turn desktop notifications off":"turn desktop notifications on",title:"desktop notification when a new credential is found",children:(0,s.jsx)("span",{className:"cbb-toggle-knob"})})]}),0===e.length?(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)("h2",{className:"audit-sec-title",children:"no credentials found"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// nothing in this machine's transcripts matched a known key format",(0,s.jsx)("br",{}),"// or a secret-named assignment."]})]}):(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)("h2",{className:"audit-sec-title",children:[e.length," credential",1===e.length?"":"s"," in your transcripts"]}),(0,s.jsx)("div",{className:"audit-sec-sub",children:"// one row per distinct key — an exposure count is not a key count."}),(0,s.jsx)("ul",{className:"leak-list",children:e.map(e=>(0,s.jsxs)("li",{className:"leak-row","data-attributed":e.attributed,children:[(0,s.jsxs)("div",{className:"leak-row-top",children:[(0,s.jsx)("code",{className:"leak-key",children:e.display}),(0,s.jsx)("span",{className:"leak-label",children:e.label}),e.name?(0,s.jsx)("span",{className:"leak-name",children:e.name}):null,(0,s.jsx)("button",{type:"button",className:"leak-dismiss",onClick:()=>void p(e.id),disabled:i===e.id,children:"not a secret"})]}),(0,s.jsxs)("div",{className:"leak-how",children:[(0,s.jsx)("span",{className:"leak-verb",children:e.mechanism})," in ",(0,s.jsx)("span",{className:"leak-where",children:e.project})," via ",(0,s.jsx)("span",{className:"leak-who",children:e.cli})," · leaked ",(0,s.jsx)("span",{className:"leak-when",children:o(e.firstSeen)}),o(e.firstSeen)!==o(e.lastSeen)?(0,s.jsxs)(s.Fragment,{children:[" · last seen ",(0,s.jsx)("span",{className:"leak-when",children:o(e.lastSeen)})]}):null]}),(0,s.jsxs)("div",{className:"leak-foot",children:[(0,s.jsxs)("span",{className:"leak-meta",children:[e.occurrences," exposure",1===e.occurrences?"":"s",e.sessions>1?` \xb7 ${e.sessions} sessions`:""," · ",e.length," chars"]}),(0,s.jsx)("span",{className:"leak-dir",children:"input"===e.direction?"sent by the agent — blockable at PreToolUse":"returned to the agent — already in the transcript"}),(0,s.jsx)("span",{className:"leak-fix",children:e.attributed?`rotate it in the ${e.label.replace(/ (API )?(key|token).*$/i,"")} console`:e.name?`find what reads ${e.name}, then rotate it there`:"trace it to its owner, then rotate it"})]})]},e.id))})]})]})}var h=e.i(86616);function p({mode:e,running:a,onStarted:n,onCompleted:t}){let{capture:i}=(0,r.usePostHog)(),l=async()=>{i("audit_first_run_clicked",{source:"empty_state",mode:e}),n();try{await (0,h.triggerRun)({cli:[],since:"all"})}catch(e){console.error("audit first run failed:",e)}finally{await t()}};return"no-cache"===e?(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," first run"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--dim)"},children:"○"})," no cache yet"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"scan and see."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let n=["1","5","8","10","13","17","20","23","25","30","32"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(n?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no audit data yet"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"run your first audit."}),(0,s.jsxs)("p",{className:"empty-sub",children:["we'll walk every transcript across your installed CLIs — Claude Code, Codex, Copilot, Cursor, OpenCode, Pi — and count every wasteful","or risky action. you'll get your agent's archetype and a punch-list."]}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("button",{type:"button",className:"btn btn-primary btn-press empty-cta",onClick:l,disabled:a,children:a?"[ scanning… ]":"[ run audit ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"scans all sessions · all installed CLIs · may take a while"})]})]})]}):(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," zero transcripts"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--amber)"},children:"●"})," hooks not installed"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"nothing to read."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let n=["2","4","9","11","16","18","23","25","27","30","33"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(n?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no sessions found"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"install hooks first."}),(0,s.jsx)("p",{className:"empty-sub",children:"failproofai couldn't find any transcripts to scan on this machine. install the hooks for at least one CLI and come back."}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("a",{href:"https://docs.befailproof.ai/getting-started",target:"_blank",rel:"noopener noreferrer",className:"btn btn-primary btn-press empty-cta",onClick:()=>{i("audit_install_guide_clicked",{source:"empty_state",mode:e})},children:"[ install guide → ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"takes about 30 seconds · one command per CLI"})]})]})]})}let m=[{label:"discovering transcripts",detail:"walking ~/.claude, ~/.codex, ~/.cursor, …"},{label:"parsing session logs",detail:"reading JSONL + sqlite session stores"},{label:"running policy checks",detail:"replaying every policy against each tool call"},{label:"aggregating results",detail:"counting hits, ranking by frequency"}];function g(){let[e,n]=(0,a.useState)(0),[t,r]=(0,a.useState)(0);(0,a.useEffect)(()=>{let e=setInterval(()=>{n(e=>Math.min(e+1,m.length-1))},4e3),s=setInterval(()=>r(e=>(e+1)%4),350);return()=>{clearInterval(e),clearInterval(s)}},[]);let i=".".repeat(t+1),l=e===m.length-1,c=Math.round(100*Math.min(.9,(e+1)/m.length*.9));return(0,s.jsxs)("section",{className:"section running-section","data-screen-label":"00 Running",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," in progress"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--accent-pink)"},children:"●"})," scanning"]})]}),(0,s.jsxs)("h2",{className:"section-h",children:["scanning sessions",i]}),(0,s.jsxs)("div",{className:"panel running-panel",children:[(0,s.jsxs)("div",{className:"running-header",children:[(0,s.jsx)("span",{className:"running-prompt",children:"$"}),(0,s.jsx)("span",{className:"running-cmd",children:"failproofai audit"}),(0,s.jsx)("span",{className:"running-cursor","aria-hidden":"true",children:"▮"})]}),(0,s.jsx)("ul",{className:"running-stages",children:m.map((a,n)=>{let r=n<e,i=n===e;return(0,s.jsxs)("li",{className:"running-stage"+(r?" done":i?" active":" queued"),children:[(0,s.jsx)("span",{className:"running-marker","aria-hidden":"true",children:r?"✓":i?"▮▮":"○"}),(0,s.jsxs)("div",{className:"running-stage-body",children:[(0,s.jsx)("div",{className:"running-stage-label",children:a.label}),i&&(0,s.jsx)("div",{className:"running-stage-detail",children:l?"finishing up…":a.detail})]}),i&&(0,s.jsx)("span",{className:"running-stage-spin","aria-hidden":"true",children:["⠋","⠙","⠹","⠸"][t]})]},n)})}),(0,s.jsxs)("div",{className:"running-bar-label",children:[(0,s.jsx)("span",{children:"progress"}),(0,s.jsxs)("span",{style:{color:"var(--dim)"},children:[c,"%"]})]}),(0,s.jsx)("div",{className:"running-bar-track",children:(0,s.jsx)("div",{className:"running-bar-fill",style:{width:`${c}%`}})}),(0,s.jsx)("p",{className:"running-foot",children:"this can take a while depending on how much session history you have."})]})]})}let x={timeout:"audit took too long — try again",network:"network hiccup — check your connection",post_failed:"audit failed — try again"};function f({status:e,onDismiss:n}){let[t,r]=(0,a.useState)(()=>Date.now());if((0,a.useEffect)(()=>{if("running"!==e.kind)return;let s=setInterval(()=>r(Date.now()),1e3);return()=>clearInterval(s)},[e.kind]),"idle"===e.kind)return null;if("running"===e.kind){let a=Math.max(0,t-e.startedAt);return(0,s.jsxs)("div",{className:"audit-progress-strip",role:"status","aria-live":"polite",children:[(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__spinner","aria-hidden":"true"}),"re-auditing your sessions"]}),(0,s.jsx)("span",{className:"audit-progress-strip__elapsed",children:function(e){if(e<0)return"00:00";let s=Math.floor(e/1e3),a=Math.floor(s/60).toString().padStart(2,"0"),n=(s%60).toString().padStart(2,"0");return`${a}:${n}`}(a)})]}),(0,s.jsx)("div",{className:"audit-progress-strip__pulse","aria-hidden":"true"})]})}return(0,s.jsx)("div",{className:"audit-progress-strip audit-progress-strip--failed",role:"alert",children:(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__x","aria-hidden":"true",children:"×"}),x[e.reason]]}),(0,s.jsx)("button",{type:"button",className:"audit-progress-strip__dismiss",onClick:n,"aria-label":"dismiss",children:"[ dismiss ]"})]})})}function j({result:e,cachedAt:n,projectFromUrl:t,isRunning:l,rerunStatus:c,onRerun:d,onDismissRerun:o}){let{capture:h}=(0,r.usePostHog)(),{detectorsTriggered:p,missing:m}=(0,a.useMemo)(()=>{let s=0,a=0;for(let n of e.results)n.hits>0&&s++,"builtin"===n.source&&!n.enabledInConfig&&n.hits>0&&a++;return{detectorsTriggered:s,missing:a}},[e]),g=(0,a.useRef)(!1);return(0,a.useEffect)(()=>{g.current||(g.current=!0,h("audit_dashboard_viewed",{missing:m,transcripts_scanned:e.transcripts.scanned,results_count:e.results.length,detectors_triggered:p}))},[h,m,e.transcripts.scanned,e.results.length,p]),(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(f,{status:c,onDismiss:o}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsxs)("div",{className:"report",children:[(0,s.jsx)(y,{transcripts:e.transcripts.scanned,events:e.eventsScanned??0,projects:e.projectsScanned.length,isRunning:l||"running"===c.kind,onRerun:()=>d("scan_header")}),(0,s.jsx)(u,{})]}),(0,s.jsx)(i,{cachedAt:n})]})]})}function y({transcripts:e,events:a,projects:n,isRunning:t,onRerun:r}){return(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"01 Scan",children:[(0,s.jsxs)("div",{className:"audit-sec-head",children:[(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"01"}),"// scan"]}),(0,s.jsx)("button",{type:"button",className:"scan-rerun",onClick:r,disabled:t,children:t?"scanning…":"run again"})]}),(0,s.jsx)("h2",{className:"audit-sec-title",children:"scan complete"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:[a.toLocaleString()," tool call",1===a?"":"s"," across ",e.toLocaleString()," ","transcript",1===e?"":"s",n>0?` \xb7 ${n.toLocaleString()} project${1===n?"":"s"}`:""]}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// the report is being rebuilt around leak detection. the scan, the",(0,s.jsx)("br",{}),"// 12-CLI transcript reader and the emailed digest are unaffected."]})]})}function N({running:e,mode:a="no-cache",rerunStatus:n,onDismissRerun:t,onStarted:r,onCompleted:l}){return(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(f,{status:n,onDismiss:t}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsx)("div",{className:"report",children:e?(0,s.jsx)(g,{}):(0,s.jsx)(p,{mode:a,running:e,onStarted:r,onCompleted:l})}),(0,s.jsx)(i,{cachedAt:null,fixed:!0})]})]})}e.s(["AuditDashboard",0,function({initial:e,projectFromUrl:n,totalCatalogSize:i}){let[l,c]=(0,a.useState)(e),[d,o]=(0,a.useState)(!1),[u,p]=(0,a.useState)({kind:"idle"}),{capture:m}=(0,r.usePostHog)(),g=(0,a.useRef)(null),x=(0,a.useRef)(!1),f="cached"===l.status?l.result.transcripts.scanned:0,y="cached"===l.status?l.result.results.length:0,b=(0,a.useCallback)(async()=>{c(await t())},[]),v=(0,a.useCallback)(async e=>{if(d)return;m("audit_rerun_clicked",{source:e,since:"all"}),o(!0);let s=Date.now();p({kind:"running",startedAt:s});try{await (0,h.triggerRun)({cli:[],since:"all",noCache:!0}),await b(),m("audit_rerun_succeeded",{source:e,since:"all",duration_ms:Date.now()-s}),p({kind:"idle"})}catch(n){let a=n instanceof h.RerunError?n.kind:"network";m("audit_rerun_failed",{kind:a,source:e,since:"all",cli_filter:"all",duration_ms:Date.now()-s}),p({kind:"failed",reason:a,failedAt:Date.now()})}finally{o(!1)}},[m,b,d]),k=(0,a.useCallback)(()=>{p({kind:"idle"})},[]);if((0,a.useEffect)(()=>(document.body.classList.add("audit-body"),()=>document.body.classList.remove("audit-body")),[]),(0,a.useEffect)(()=>{let e=d?"running":"empty"===l.status?"empty":0===f?"zero_sessions":"report";g.current!==e&&(g.current=e,m("audit_page_viewed",{state:e,has_cache:"cached"===l.status}))},[l.status,m,d,f]),(0,a.useEffect)(()=>{x.current=!1},[l.status,d,f]),(0,a.useEffect)(()=>{if(d||"cached"!==l.status||0===f)return;let e=0,s=()=>{if(e=0,x.current)return;let s=document.documentElement.scrollHeight-window.innerHeight;s<=0||window.scrollY>=s-24&&(x.current=!0,m("audit_page_scrolled_to_end",{results_count:y,transcripts_scanned:f}))},a=()=>{0===e&&(e=requestAnimationFrame(s))};return s(),window.addEventListener("scroll",a,{passive:!0}),()=>{window.removeEventListener("scroll",a),0!==e&&cancelAnimationFrame(e)}},[l.status,m,y,d,f]),"empty"===l.status&&!d)return(0,s.jsx)(N,{running:!1,rerunStatus:u,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await b()}});if("empty"===l.status&&d)return(0,s.jsx)(N,{running:!0,rerunStatus:u,onDismissRerun:k,onStarted:()=>{},onCompleted:async()=>{o(!1),await b()}});let w="cached"===l.status?l.result:null;if(!w)return null;let S="cached"===l.status?l.cachedAt:null;return 0===w.transcripts.scanned?(0,s.jsx)(N,{running:d,mode:"zero-sessions",rerunStatus:u,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await b()}}):(0,s.jsx)(j,{result:w,cachedAt:S,projectFromUrl:n,isRunning:d,rerunStatus:u,onRerun:e=>v(e),onDismissRerun:k})}],24358)},86616,29054,e=>{"use strict";function s(e,a={},n=15e3){let t=AbortSignal.timeout(n),r=a.signal?AbortSignal.any([a.signal,t]):t;return fetch(e,{...a,signal:r})}function a(e){if(null===e||"object"!=typeof e)return!1;let s=e.name;return"AbortError"===s||"TimeoutError"===s}e.s(["fetchWithTimeout",0,s,"isAbortError",0,a],29054);class n extends Error{kind;constructor(e,s){super(s),this.kind=e,this.name="RerunError"}}async function t(e){try{let a=await s("/api/audit/run",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cli:e.cli.length>0?e.cli:void 0,since:"all"===e.since?void 0:e.since,noCache:!!e.noCache||void 0})});if(!a.ok&&409!==a.status){let e=await a.text().catch(()=>"");throw console.error("audit run failed:",a.status,e),new n("post_failed",`audit run failed (${a.status})`)}}catch(e){if(e instanceof n)throw e;throw console.error("audit run request failed:",e),new n(a(e)?"timeout":"network","audit run request failed")}let t=0;for(;;){await new Promise(e=>setTimeout(e,1e3));let e=null;try{let a=await s("/api/audit/status",{cache:"no-store"});a.ok&&(e=await a.json())}catch{}if(null===e){if(++t>=10)throw new n("network","audit status poll lost the server");continue}if(t=0,!e.running){if(e.error)throw new n("post_failed",e.error);return}}}e.s(["RerunError",0,n,"triggerRun",0,t],86616)}]);

package/.next/standalone/app/actions/get-leaks.ts

@@ -1,6 +1,10 @@
 "use server";
 
-import { activeFindings, dismissFinding, readLeakRecord } from "@/src/audit/leak-store";
+import {
+  activeFindings,
+  dismissFinding,
+  readLeakRecord,
+} from "@/src/audit/leak-store";
 import { readConfig, updateConfig } from "@/src/hooks/fp-config";
 
 /**

package/.next/standalone/app/actions/update-scheduled-audit.ts

@@ -18,7 +18,6 @@
  */
 
 import { readConfig, updateConfig } from "@/src/hooks/fp-config";
-import { readAuth, whoAmI } from "@/lib/auth/auth-store";
 
 /**
  * The outcome of trying to turn scheduling on.
@@ -34,70 +33,19 @@ import { readAuth, whoAmI } from "@/lib/auth/auth-store";
  * A returned discriminant survives the boundary, so the caller can open the
  * sign-in dialog for the one failure that has an obvious next step.
  */
-export type SetAutoAuditResult =
-  | { ok: true; auto: boolean }
-  | { ok: false; reason: "signed-out" }
-  /**
-   * The session is intact locally and the api-server could not be reached.
-   *
-   * Separated from `signed-out` because `whoAmI()` collapses them: it returns
-   * null for a 401 AND for every transport failure, so an offline machine, a
-   * proxy that blocks the host, and a genuinely expired token were one answer.
-   * The user was told "that sign-in expired" and handed a code prompt that
-   * cannot succeed either — the failure it names is not the failure they have,
-   * and following its advice costs them a real, working session.
-   */
-  | { ok: false; reason: "unreachable" };
+export type SetAutoAuditResult = { ok: true; auto: boolean };
 
 /**
  * Turn the scheduled scan on or off.
  *
- * Turning it ON is refused without a session. Scheduling and mailing are ONE
- * decision — the reason to put a scan on a timer is to be told what it found —
- * so a machine with the timer set and nobody to tell is a switch that reads as
- * on and produces nothing, discoverable only by noticing that no digest ever
- * arrives. The caller signs the user in first and retries.
- *
- * `whoAmI()` asks the SERVER, so this refuses in a case the page cannot see: a
- * session file that exists locally but whose refresh token the api-server has
- * rejected. The local file is what the page reads to show "reports go to …", so
- * the two disagree exactly when a session has expired or was minted against a
- * different server — and that disagreement is the common case, not an edge one.
- *
- * Turning it OFF never checks. An expired session must not be able to trap
- * somebody into keeping a feature they are trying to disable.
- *
- * Note this gates SETTING UP the timer, not the machine's ongoing work: a
- * session that later expires leaves the timer running and the local scan
- * working, and only the digest stops. See `report-harm.ts`.
+ * Scheduling is local and independent of authentication. A signed-in identity
+ * adds email delivery; without one the scan and desktop notification continue.
  *
  * Returns the value actually stored (re-read), so an optimistic UI can confirm
  * against the source of truth rather than assume its own guess landed.
  */
 export async function setAutoAuditAction(enabled: boolean): Promise<SetAutoAuditResult> {
-  if (enabled) {
-    const who = await whoAmI();
-    if (!who) {
-      // `whoAmI()` deletes the session on a 401 and leaves it alone on a
-      // transport failure, so what is left ON DISK is the one thing that tells
-      // the two apart — no extra request, and nothing new that can fail.
-      const local = readAuth();
-      const stillWithinWindow = local && local.refresh_expires_at * 1000 > Date.now();
-      return { ok: false, reason: stillWithinWindow ? "unreachable" : "signed-out" };
-    }
-  }
-  // Enabling stamps consent in the same write, because the `whoAmI()` above is
-  // exactly what makes this a consent record rather than a guess: a person was
-  // present, signed in, and looking at the panel that enumerates what gets
-  // sent. `reportHarm` gates sending on the stamp, not on `auto`, so a machine
-  // that inherited `auto` from a release where it meant "scan locally on a
-  // timer" mails nothing until somebody passes through here or the CLI.
-  //
-  // Disabling leaves the stamp alone. It is a record of something that did
-  // happen, and it grants nothing on its own — sending needs `auto` too.
-  const next = updateConfig({
-    audit: enabled ? { auto: true, reportsConsentedAt: Date.now() } : { auto: false },
-  });
+  const next = updateConfig({ audit: { auto: enabled } });
   return { ok: true, auto: next.audit.auto };
 }
 

package/.next/standalone/app/api/auth/status/route.ts

@@ -7,8 +7,9 @@
  * This keeps the dashboard UI and the CLI consistent regardless of whether
  * the api-server is reachable.
  *
- * Reminders are gone: the machine now audits itself on a timer and mails a
- * digest when it finds harm, so there is nothing to nudge anyone about. The
+ * Reminders are gone: the machine now audits itself on a timer and can mail an
+ * alert when it finds a credential leak, so there is nothing to nudge anyone
+ * about. The
  * scheduled-scan state lives in `getScheduledAuditAction`, which reads it from
  * the config and the daemon rather than from here.
  */

package/.next/standalone/app/audit/_components/audit-dashboard.tsx

@@ -59,7 +59,9 @@ type Initial =
 /** Tag passed to the shared `startRerun()` handler so PostHog can tell
  *  whether the click came from the bottom return-section button or the
  *  empty-state CTA. */
-export type RerunSource = "return_section" | "empty_state";
+// `scan_header` is the button in section 01 — the only re-scan control the
+// page has now that the old report's sections are switched off.
+export type RerunSource = "return_section" | "empty_state" | "scan_header";
 
 interface Props {
   initial: Initial;
@@ -365,6 +367,8 @@ function MainReport({
             transcripts={result.transcripts.scanned}
             events={result.eventsScanned ?? 0}
             projects={result.projectsScanned.length}
+            isRunning={isRunning || rerunStatus.kind === "running"}
+            onRerun={() => onRerun("scan_header")}
           />
           {/* The rebuilt report. It reads the leak record rather than this
               scan's result, deliberately: a credential found last month and
@@ -417,7 +421,19 @@ function MainReport({
  * under construction" and "this product is broken".
  */
 function AuditReportPlaceholder(
-  { transcripts, events, projects }: { transcripts: number; events: number; projects: number },
+  {
+    transcripts,
+    events,
+    projects,
+    isRunning,
+    onRerun,
+  }: {
+    transcripts: number;
+    events: number;
+    projects: number;
+    isRunning: boolean;
+    onRerun: () => void;
+  },
 ) {
   const n = (x: number) => x.toLocaleString();
   return (
@@ -426,6 +442,17 @@ function AuditReportPlaceholder(
         <span className="audit-sec-eyebrow">
           <span className="ix">01</span>{"// scan"}
         </span>
+        {/* The re-scan control. It lived in the old report's sections and went
+            dormant when they were commented out, which left the page with no way
+            to run an audit again at all — you had to go back to the terminal. */}
+        <button
+          type="button"
+          className="scan-rerun"
+          onClick={onRerun}
+          disabled={isRunning}
+        >
+          {isRunning ? "scanning…" : "run again"}
+        </button>
       </div>
       <h2 className="audit-sec-title">scan complete</h2>
       <div className="audit-sec-sub">

package/.next/standalone/app/audit/_components/leak-section.tsx

@@ -140,14 +140,27 @@ export function LeakSection() {
                 {/* The 5W1H, as one sentence rather than a grid of labelled
                     cells — a person reading a leak wants the story, and the
                     grid version made every row look like a form to fill in. */}
+                {/* The date is FIRST seen, not last. "When did this key get
+                    into a transcript" is the question a leak raises; "when did
+                    I last run a scan that noticed" is not. They also looked
+                    identical in practice — the record keeps the 500 most
+                    recently seen findings, so everything surviving the cap
+                    reported the same recent `lastSeen` and every row read
+                    "today", which is true and useless. */}
                 <div className="leak-how">
                   <span className="leak-verb">{row.mechanism}</span>
                   {" in "}
                   <span className="leak-where">{row.project}</span>
                   {" via "}
                   <span className="leak-who">{row.cli}</span>
-                  {" · "}
-                  <span className="leak-when">{when(row.lastSeen)}</span>
+                  {" · leaked "}
+                  <span className="leak-when">{when(row.firstSeen)}</span>
+                  {when(row.firstSeen) !== when(row.lastSeen) ? (
+                    <>
+                      {" · last seen "}
+                      <span className="leak-when">{when(row.lastSeen)}</span>
+                    </>
+                  ) : null}
                 </div>
 
                 <div className="leak-foot">

package/.next/standalone/app/audit/audit-styles.css

@@ -1270,3 +1270,21 @@
   .leak-dismiss { margin-left: 0; }
   .leak-foot { gap: 6px; flex-direction: column; }
 }
+
+/* The re-scan control in the scan header. Sits at the end of the eyebrow row so
+   it reads as an action on that section rather than a page-level nav item. */
+.scan-rerun {
+  margin-left: auto;
+  font-family: var(--font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.1em;
+  text-transform: lowercase;
+  color: var(--ink-2);
+  background: none;
+  border: 1px solid var(--line-2);
+  padding: 4px 10px;
+  cursor: pointer;
+}
+.scan-rerun:hover:not(:disabled) { color: var(--ink); border-color: var(--accent-pink); }
+.scan-rerun:disabled { opacity: 0.5; cursor: not-allowed; }
+.scan-rerun:focus-visible { outline: 2px solid var(--accent-pink); outline-offset: 2px; }

package/.next/standalone/app/settings/page.tsx

@@ -30,7 +30,7 @@ export const dynamic = "force-dynamic";
 export default async function SettingsPage() {
   // Same gate the audit, policies and projects pages carry. It was dropped in
   // the rewrite, and this is the page that least deserves to lose it: it shows
-  // the address digests go to and can sign the machine out, on a dashboard an
+  // the address credential alerts go to and can sign the machine out, on a dashboard an
   // operator may deliberately be exposing beyond localhost.
   const disabled = (process.env.FAILPROOFAI_DISABLE_PAGES ?? "")
     .split(",").map((s) => s.trim()).filter(Boolean);

package/.next/standalone/app/settings/settings-client.tsx

@@ -187,12 +187,9 @@ function Toggle({
  * What the scan does, as three labelled lines. This is the old footer paragraph
  * restructured — same claims, scannable instead of a wall.
  *
- * "sends" ENUMERATES rather than saying "only counts and redacted examples".
- * That was very nearly true, and very nearly true is the worse kind: the report
- * carries the machine's name too — its hostname, which routinely carries its
- * owner's. A list a person can check beats a stronger claim they cannot, and
- * this panel is the one place they would come to check. The digest email states
- * the same three, in the same order.
+ * "sends" names the exact remote payload. The scheduled scan itself stays
+ * local, and no report is attempted unless a credential leak exists and the
+ * machine has a verified email identity.
  */
 const HOW_IT_WORKS: ReadonlyArray<{ label: string; body: string }> = [
   {
@@ -202,7 +199,7 @@ const HOW_IT_WORKS: ReadonlyArray<{ label: string; body: string }> = [
   { label: "runs", body: "entirely on this machine. the transcripts never leave it." },
   {
     label: "sends",
-    body: "counts, redacted examples, and this machine's name — and only when a scan finds something harmful.",
+    body: "only the newest masked credential exposure, its CLI, time, location, and this machine's name — only when email is configured.",
   },
 ];
 
@@ -312,26 +309,6 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
     setBusy(true);
     try {
       const res = await setAutoAuditAction(true);
-      if (!res.ok) {
-        setAuto(false);
-        if (res.reason === "unreachable") {
-          // The session is fine and the network is not. Offering a code prompt
-          // here would name a failure the user does not have and hand them a
-          // flow that cannot succeed either — and abandoning it mid-way is how
-          // a working session gets replaced with none at all.
-          toast("could not reach the server. check your connection and try again.");
-          return;
-        }
-        // The server rejected the session this page had been showing an address
-        // for — expired, or minted against a different api-server. The local
-        // file is the only thing that said "signed in", and `whoAmI` has since
-        // cleared it, so re-read before opening the dialog: otherwise the page
-        // asks for an email while still displaying one.
-        await reload();
-        setAuthOpen(true);
-        toast("that sign-in expired. one more code and it's on.");
-        return;
-      }
       setAuto(res.auto);
       toast("scheduled audits on.");
       await reload();
@@ -360,13 +337,8 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
       }
       return;
     }
-    // Turning it on needs somewhere to send the digest.
-    if (!signedIn) {
-      setAuthOpen(true);
-      return;
-    }
     await enable();
-  }, [auto, enable, reload, signedIn]);
+  }, [auto, enable, reload]);
 
   const commitInterval = useCallback(
     async (raw: number) => {
@@ -403,7 +375,7 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
     setBusy(true);
     try {
       await fetch("/api/auth/logout", { method: "POST" });
-      toast("signed out. scans continue; digests pause.");
+      toast("signed out. scans and desktop notifications continue; email alerts pause.");
       await reload();
     } catch {
       toast("could not sign out.");
@@ -534,7 +506,9 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                     </span>
                     <span className="set-dim">
                       {auto
-                        ? "you'll get an email only when a scan finds something."
+                        ? signedIn
+                          ? "system notification on leaks; the latest masked leak is also emailed."
+                          : "system notification on leaks. add an email below for masked alerts."
                         : "off. nothing runs and nothing is sent."}
                     </span>
                   </div>
@@ -593,7 +567,7 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                     // from it at all.
                     <>
                       <span className="set-warn">
-                        signed out — scans continue, digests are paused.
+                        signed out — scans and desktop notifications continue; email alerts are paused.
                       </span>
                       <button
                         type="button"
@@ -601,13 +575,13 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                         disabled={busy}
                         onClick={() => setAuthOpen(true)}
                       >
-                        sign in to resume
+                        add email alerts
                       </button>
                     </>
                   ) : (
                     <span className="set-dim">
-                      turning this on asks for an email, so there is somewhere to
-                      send the report.
+                      scans and desktop notifications work without an account.
+                      add email later if you want leak alerts in your inbox.
                     </span>
                   )}
                 </div>

package/.next/standalone/lib/auth/api-server-client.ts

@@ -257,7 +257,7 @@ export interface AuditReportBody {
    * Credentials this machine found in its own transcripts.
    *
    * Optional on the wire, so a CLI newer than the api-server sends a field the
-   * server ignores rather than failing the whole digest — the harmful counts
+   * server ignores rather than failing the whole report — the harmful counts
    * are the older half of the contract and must keep arriving either way.
    *
    * Every field here is a mask, a label, a length or a location. There is no
@@ -287,15 +287,15 @@ export interface AuditReportResult {
   report_id: string;
   /** Whether this report produced an email. */
   emailed: boolean;
-  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
+  /** `no_leak`, `cooldown`, `send_failed`, or null when mail went out. */
   reason: string | null;
   /**
    * Where the next window starts, per the SERVER.
    *
    * Persisted verbatim rather than computed locally. The server anchors it on
-   * the last DELIVERED digest, so a report held by the cooldown — or one whose
+   * the last DELIVERED alert, so a report held by the cooldown — or one whose
    * send failed — correctly leaves the watermark where it was, and its findings
-   * turn up in the next digest instead of falling into a gap. A machine that
+   * turn up in the next alert instead of falling into a gap. A machine that
    * lost `machine.json` also resyncs here rather than re-reporting from the
    * beginning of time.
    */
@@ -303,11 +303,11 @@ export interface AuditReportResult {
 }
 
 /**
- * Submit one scheduled scan's harmful findings.
+ * Submit one scheduled scan's harmful findings and newest masked credential.
  *
  * Called only by the audit child, and only on `--scheduled`. The destination
  * address is never sent: the api-server takes it from the access-token claims,
- * so a report cannot name where its digest goes.
+ * so a report cannot name where its email alert goes.
  */
 export async function submitAuditReport(
   accessToken: string,

package/.next/standalone/lib/codex-sessions.ts

@@ -158,6 +158,21 @@ function joinTexts(blocks: CodexContentBlock[] | undefined, wantedType: "input_t
     .join("\n");
 }
 
+/** Text carried by tool outputs. Newer Codex chronicles use an array of
+ * `input_text` blocks for `custom_tool_call_output`, while older releases use
+ * one string for `function_call_output`. */
+function toolOutputText(output: unknown): string {
+  if (typeof output === "string") return output;
+  if (Array.isArray(output)) {
+    return output
+      .filter((block): block is CodexContentBlock => !!block && typeof block === "object")
+      .map((block) => typeof block.text === "string" ? block.text : "")
+      .filter(Boolean)
+      .join("\n");
+  }
+  return output === undefined ? "" : JSON.stringify(output);
+}
+
 /**
  * Parse a Codex JSONL transcript into `LogEntry[]` plus the raw lines.
  * Yields to the event loop every 200 lines so big transcripts don't block.
@@ -250,10 +265,11 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call") {
+      if (subType === "function_call" || subType === "custom_tool_call") {
         const callId = payload.call_id as string | undefined;
         const name = (payload.name as string | undefined) ?? "function_call";
-        const input = safeJsonParse(payload.arguments as string | undefined);
+        const encodedInput = (payload.arguments ?? payload.input) as string | undefined;
+        const input = safeJsonParse(encodedInput);
         const toolUse: ToolUseBlock = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -273,7 +289,7 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call_output") {
+      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
         const callId = payload.call_id as string | undefined;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -282,7 +298,7 @@ export async function parseCodexLog(
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: typeof payload.output === "string" ? (payload.output as string) : JSON.stringify(payload.output),
+            content: toolOutputText(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration),
           };

package/.next/standalone/lib/copilot-sessions.ts

@@ -151,6 +151,11 @@ interface CopilotToolResult {
   detailedContent?: string;
 }
 
+interface CopilotHookToolResult {
+  textResultForLlm?: string;
+  sessionLog?: string;
+}
+
 interface CopilotToolTelemetry {
   metrics?: { commandTimeMs?: number; durationMs?: number };
   properties?: Record<string, unknown>;
@@ -171,6 +176,8 @@ export async function parseCopilotLog(
   // toolCallId → tool_use block, so we can attach tool.execution_complete back.
   const toolUseById = new Map<string, ToolUseBlock>();
   const toolUseStartMs = new Map<string, number>();
+  let mostRecentToolUse: ToolUseBlock | undefined;
+  let mostRecentToolUseStartMs = 0;
   let cwd: string | undefined;
   let seenSessionStart = false;
 
@@ -273,9 +280,32 @@ export async function parseCopilotLog(
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
+      mostRecentToolUse = toolUse;
+      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
 
+    // Copilot CLI 1.0.39 can omit the command's real stdout from
+    // `tool.execution_complete` and expose it only to the PostToolUse hook as
+    // `input.toolResult.textResultForLlm`. That is the value the model saw and
+    // the value failproofai must audit. Keep it on the active tool block; the
+    // later completion record may still contribute timing, but must not replace
+    // this output with its shorter status-only summary.
+    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
+      const input = (data.input as Record<string, unknown> | undefined) ?? {};
+      const hookResult = (input.toolResult as CopilotHookToolResult | undefined) ?? {};
+      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
+      if (typeof hookContent === "string" && hookContent.length > 0) {
+        mostRecentToolUse.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: hookContent,
+          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
+          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs)),
+        };
+      }
+    }
+
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId as string | undefined;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -289,7 +319,8 @@ export async function parseCopilotLog(
           typeof reportedMs === "number" && reportedMs >= 0
             ? reportedMs
             : Math.max(0, date.getTime() - startMs);
-        const content = result.detailedContent ?? result.content ?? "";
+        const completionContent = result.detailedContent ?? result.content ?? "";
+        const content = block.result?.content || completionContent;
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),