failproofai 1.0.4-beta.2 → 1.0.4-beta.6

package/lib/auth/api-server-client.ts

@@ -257,7 +257,7 @@ export interface AuditReportBody {
    * Credentials this machine found in its own transcripts.
    *
    * Optional on the wire, so a CLI newer than the api-server sends a field the
-   * server ignores rather than failing the whole digest — the harmful counts
+   * server ignores rather than failing the whole report — the harmful counts
    * are the older half of the contract and must keep arriving either way.
    *
    * Every field here is a mask, a label, a length or a location. There is no
@@ -287,15 +287,15 @@ export interface AuditReportResult {
   report_id: string;
   /** Whether this report produced an email. */
   emailed: boolean;
-  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
+  /** `no_leak`, `cooldown`, `send_failed`, or null when mail went out. */
   reason: string | null;
   /**
    * Where the next window starts, per the SERVER.
    *
    * Persisted verbatim rather than computed locally. The server anchors it on
-   * the last DELIVERED digest, so a report held by the cooldown — or one whose
+   * the last DELIVERED alert, so a report held by the cooldown — or one whose
    * send failed — correctly leaves the watermark where it was, and its findings
-   * turn up in the next digest instead of falling into a gap. A machine that
+   * turn up in the next alert instead of falling into a gap. A machine that
    * lost `machine.json` also resyncs here rather than re-reporting from the
    * beginning of time.
    */
@@ -303,11 +303,11 @@ export interface AuditReportResult {
 }
 
 /**
- * Submit one scheduled scan's harmful findings.
+ * Submit one scheduled scan's harmful findings and newest masked credential.
  *
  * Called only by the audit child, and only on `--scheduled`. The destination
  * address is never sent: the api-server takes it from the access-token claims,
- * so a report cannot name where its digest goes.
+ * so a report cannot name where its email alert goes.
  */
 export async function submitAuditReport(
   accessToken: string,

package/lib/codex-sessions.ts

@@ -158,6 +158,21 @@ function joinTexts(blocks: CodexContentBlock[] | undefined, wantedType: "input_t
     .join("\n");
 }
 
+/** Text carried by tool outputs. Newer Codex chronicles use an array of
+ * `input_text` blocks for `custom_tool_call_output`, while older releases use
+ * one string for `function_call_output`. */
+function toolOutputText(output: unknown): string {
+  if (typeof output === "string") return output;
+  if (Array.isArray(output)) {
+    return output
+      .filter((block): block is CodexContentBlock => !!block && typeof block === "object")
+      .map((block) => typeof block.text === "string" ? block.text : "")
+      .filter(Boolean)
+      .join("\n");
+  }
+  return output === undefined ? "" : JSON.stringify(output);
+}
+
 /**
  * Parse a Codex JSONL transcript into `LogEntry[]` plus the raw lines.
  * Yields to the event loop every 200 lines so big transcripts don't block.
@@ -250,10 +265,11 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call") {
+      if (subType === "function_call" || subType === "custom_tool_call") {
         const callId = payload.call_id as string | undefined;
         const name = (payload.name as string | undefined) ?? "function_call";
-        const input = safeJsonParse(payload.arguments as string | undefined);
+        const encodedInput = (payload.arguments ?? payload.input) as string | undefined;
+        const input = safeJsonParse(encodedInput);
         const toolUse: ToolUseBlock = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -273,7 +289,7 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call_output") {
+      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
         const callId = payload.call_id as string | undefined;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -282,7 +298,7 @@ export async function parseCodexLog(
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: typeof payload.output === "string" ? (payload.output as string) : JSON.stringify(payload.output),
+            content: toolOutputText(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration),
           };

package/lib/copilot-sessions.ts

@@ -151,6 +151,11 @@ interface CopilotToolResult {
   detailedContent?: string;
 }
 
+interface CopilotHookToolResult {
+  textResultForLlm?: string;
+  sessionLog?: string;
+}
+
 interface CopilotToolTelemetry {
   metrics?: { commandTimeMs?: number; durationMs?: number };
   properties?: Record<string, unknown>;
@@ -171,6 +176,8 @@ export async function parseCopilotLog(
   // toolCallId → tool_use block, so we can attach tool.execution_complete back.
   const toolUseById = new Map<string, ToolUseBlock>();
   const toolUseStartMs = new Map<string, number>();
+  let mostRecentToolUse: ToolUseBlock | undefined;
+  let mostRecentToolUseStartMs = 0;
   let cwd: string | undefined;
   let seenSessionStart = false;
 
@@ -273,9 +280,32 @@ export async function parseCopilotLog(
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
+      mostRecentToolUse = toolUse;
+      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
 
+    // Copilot CLI 1.0.39 can omit the command's real stdout from
+    // `tool.execution_complete` and expose it only to the PostToolUse hook as
+    // `input.toolResult.textResultForLlm`. That is the value the model saw and
+    // the value failproofai must audit. Keep it on the active tool block; the
+    // later completion record may still contribute timing, but must not replace
+    // this output with its shorter status-only summary.
+    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
+      const input = (data.input as Record<string, unknown> | undefined) ?? {};
+      const hookResult = (input.toolResult as CopilotHookToolResult | undefined) ?? {};
+      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
+      if (typeof hookContent === "string" && hookContent.length > 0) {
+        mostRecentToolUse.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: hookContent,
+          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
+          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs)),
+        };
+      }
+    }
+
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId as string | undefined;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -289,7 +319,8 @@ export async function parseCopilotLog(
           typeof reportedMs === "number" && reportedMs >= 0
             ? reportedMs
             : Math.max(0, date.getTime() - startMs);
-        const content = result.detailedContent ?? result.content ?? "";
+        const completionContent = result.detailedContent ?? result.content ?? "";
+        const content = block.result?.content || completionContent;
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),

package/lib/cursor-sessions.ts

@@ -127,7 +127,15 @@ interface CursorRecord {
   /** Cursor 2026-04+ transcript shape: `{role, message: {content: [...]}}`. */
   role?: "user" | "assistant" | "system" | string;
   message?: {
-    content?: Array<{ type?: string; text?: string }>;
+    content?: Array<{
+      type?: string;
+      text?: string;
+      id?: string;
+      name?: string;
+      input?: Record<string, unknown>;
+      tool_use_id?: string;
+      content?: unknown;
+    }>;
   };
 }
 
@@ -183,11 +191,36 @@ export async function parseCursorLog(
     if (!raw.type && raw.role && raw.message?.content) {
       const synthDate = new Date(SYNTH_T0 + i);
       const synthTs = synthDate.toISOString();
-      const textParts = raw.message.content
+      const messageContent = raw.message.content;
+      const textParts = messageContent
         .filter((c) => c?.type === "text" && typeof c.text === "string")
         .map((c) => c.text!)
         .join("");
       if (raw.role === "user") {
+        // Some Cursor builds emit Claude-style tool_result blocks in the next
+        // user record. Pair them before treating any remaining text as a user
+        // turn so command output is available to the credential scanner.
+        let attachedResult = false;
+        for (const block of messageContent) {
+          if (block?.type !== "tool_result") continue;
+          const callId = typeof block.tool_use_id === "string" ? block.tool_use_id : undefined;
+          const toolUse = callId ? toolUseById.get(callId) : undefined;
+          if (!toolUse) continue;
+          const durationMs = Math.max(
+            0,
+            synthDate.getTime() - (toolUseStartMs.get(callId!) ?? synthDate.getTime()),
+          );
+          toolUse.result = {
+            timestamp: synthTs,
+            timestampFormatted: formatTimestamp(synthDate),
+            content: typeof block.content === "string"
+              ? block.content
+              : block.content == null ? "" : JSON.stringify(block.content),
+            durationMs,
+            durationFormatted: formatDuration(durationMs),
+          };
+          attachedResult = true;
+        }
         // Strip the synthesized `<timestamp>...</timestamp>\n<user_query>...\n</user_query>`
         // wrapper Cursor adds for context — keep just the user_query body.
         const queryMatch = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/.exec(textParts);
@@ -198,13 +231,37 @@ export async function parseCursorLog(
             ...baseEntry(rawCopy, synthTs, synthDate, source),
             message: { role: "user", content: text },
           } satisfies UserEntry);
+        } else if (!attachedResult) {
+          entries.push({
+            type: "system",
+            ...baseEntry(rawCopy, synthTs, synthDate, source),
+            raw: rawCopy,
+          } satisfies GenericEntry);
         }
         continue;
       }
       if (raw.role === "assistant") {
-        const blocks: ContentBlock[] = textParts
-          ? [{ type: "text", text: textParts }]
-          : [];
+        const blocks: ContentBlock[] = [];
+        if (textParts) blocks.push({ type: "text", text: textParts });
+        for (let j = 0; j < messageContent.length; j++) {
+          const contentBlock = messageContent[j];
+          if (contentBlock?.type !== "tool_use") continue;
+          const name = typeof contentBlock.name === "string" ? contentBlock.name : "tool";
+          const id = typeof contentBlock.id === "string" && contentBlock.id
+            ? contentBlock.id
+            : `cursor-${i}-${name}-${j}`;
+          const toolUse: ToolUseBlock = {
+            type: "tool_use",
+            id,
+            name,
+            input: contentBlock.input && typeof contentBlock.input === "object"
+              ? contentBlock.input
+              : {},
+          };
+          blocks.push(toolUse);
+          toolUseById.set(id, toolUse);
+          toolUseStartMs.set(id, synthDate.getTime());
+        }
         if (blocks.length === 0) {
           entries.push({
             type: "system",

package/lib/sqlite-reader.ts

@@ -39,8 +39,42 @@ interface NodeSqliteModule {
   DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeSqliteDb;
 }
 
+/**
+ * Swallow Node's "SQLite is an experimental feature" warning, once.
+ *
+ * It is not information the user can act on — we chose `node:sqlite`
+ * deliberately, and the alternative tier is a WASM build that leaks. But it is
+ * emitted on first use, which lands it in the MIDDLE of whatever is on screen,
+ * and the audit's progress display redraws itself by moving the cursor up a
+ * fixed number of lines. Two unexpected lines of stderr push the cursor down
+ * two rows, so the next redraw repaints the block two rows lower and strands
+ * the top of the previous frame above it. The user sees every stage twice and
+ * reasonably concludes the audit ran twice.
+ *
+ * Filtered by message rather than silenced wholesale: `process.emitWarning` is
+ * how deprecations and real problems surface too, and a blanket
+ * `NODE_NO_WARNINGS` in a tool that installs into other people's machines would
+ * hide those as well.
+ */
+let warningPatched = false;
+function silenceSqliteExperimentalWarning(): void {
+  if (warningPatched) return;
+  warningPatched = true;
+  const original = process.emitWarning.bind(process);
+  // The overloads differ across Node versions; the shape we care about is the
+  // first argument, and everything else is passed straight through.
+  process.emitWarning = ((warning: unknown, ...rest: unknown[]) => {
+    const text = typeof warning === "string" ? warning : String((warning as Error)?.message ?? "");
+    if (text.includes("SQLite is an experimental feature")) return;
+    return (original as (...a: unknown[]) => void)(warning, ...rest);
+  }) as typeof process.emitWarning;
+}
+
 async function tryNodeSqlite(dbPath: string): Promise<SqliteReader | null> {
   try {
+    // Before the import, not after: the warning fires on first use of the
+    // module, which is this line.
+    silenceSqliteExperimentalWarning();
     // Dynamic import: on Node < 22.5 this rejects and we fall through to sql.js.
     const mod = (await import("node:sqlite")) as unknown as NodeSqliteModule;
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
@@ -66,10 +100,53 @@ function loadSqlJs(): Promise<SqlJsStatic> {
   return sqlPromise;
 }
 
+const SQLITE_MAGIC = "SQLite format 3\0";
+
+/**
+ * Clear the WAL flag on OUR OWN in-memory copy of the database image.
+ *
+ * Header bytes 18 and 19 are the file-format write and read versions; `2`
+ * means WAL. sql.js never sees the `-wal` sidecar — it is handed the main
+ * file's bytes and nothing else, which is exactly the snapshot caveat this
+ * module already documents — so the flag buys us nothing, and it costs a great
+ * deal: opening a WAL-flagged image makes SQLite build a wal-index
+ * shared-memory region that sql.js's MEMFS-backed VFS never reclaims on
+ * `close()` (close unlinks only the db file it created).
+ *
+ * The asm.js build's heap is a FIXED 22,151,168-byte ArrayBuffer with
+ * ALLOW_MEMORY_GROWTH off, so `emscripten_resize_heap` is compiled to
+ * `abort("OOM")`. Measured: the 128th WAL-mode open exhausts it — the same
+ * threshold for a 319 KB database and a 10 MB one, because the leaked region
+ * is a fixed per-connection allocation rather than data.
+ *
+ * And the abort is not confined to that open. `initSqlJs` memoizes one
+ * process-wide module, so once it aborts every later `openSqliteReadonly`
+ * silently returns null. A full audit opens ~150 databases — devin, goose and
+ * opencode each open theirs once per SESSION — so it crossed 128 and then
+ * dropped whatever it had not yet read, with no error anywhere. The
+ * `Aborted(OOM)` lines on stderr were the only symptom, and they read as
+ * harmless because the run still completed.
+ *
+ * Only under bun and Node < 22.5: tier 1 is `node:sqlite`, which bun does not
+ * provide, and `engines.node` allows 20.9. Both fall through to here.
+ */
+function clearWalFlag(bytes: Buffer): Buffer {
+  // Too short to carry a header, or not a SQLite image at all — hand it back
+  // untouched and let sql.js produce its own error.
+  if (bytes.length < 20) return bytes;
+  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC) return bytes;
+  if (bytes[18] === 1 && bytes[19] === 1) return bytes; // already rollback-journal
+  bytes[18] = 1;
+  bytes[19] = 1;
+  return bytes;
+}
+
 async function trySqlJs(dbPath: string): Promise<SqliteReader | null> {
   try {
     const SQL = await loadSqlJs();
-    const db = new SQL.Database(readFileSync(dbPath));
+    // `readFileSync` already returns a private copy, so mutating the two header
+    // bytes cannot touch the file on disk.
+    const db = new SQL.Database(clearWalFlag(readFileSync(dbPath)));
     return {
       query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[] {
         const stmt = db.prepare(sql);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.4-beta.2",
+  "version": "1.0.4-beta.6",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -117,19 +117,19 @@
     "vite": "8.0.16",
     "undici": "7.29.0",
     "brace-expansion": "5.0.9",
-    "sharp": "0.35.0",
+    "sharp": "0.35.4",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.6"
   },
   "failproofaidBinaries": {
-    "linux-x64": "3039575242ff240c68a79c4ebd4e0e35e865da99c6d8a46d1a17b2d7962cb47b",
-    "linux-arm64": "02fe993dca0faccb528c48472ca1d637274c562992ba7da1bc8d439103dbcc13",
-    "darwin-x64": "2be5a422007a773253611f24f2ad9e2a301f075392ed7bc2dc0f6354d3186696",
-    "darwin-arm64": "5882a4acd7317289346934290ac8277ca79edadb009e284c9fc0b23b74d321d7"
+    "linux-x64": "24118b8bd058cc5d8711053c4c77cdca9361c12dbf0f421a757d33f07596d428",
+    "linux-arm64": "b4278c34a288de2c747bcebcc623d8fd5bda3a1f1e55800926eb1a4b89f0a5e9",
+    "darwin-x64": "ecb66699f45f605b0d54ac9e4bac360ac11e4e136442dcccdd083514d77c7d42",
+    "darwin-arm64": "b3dbad58bda960ef9481f90bc5085ba8624b2472519cc0bf212a0e8451dd2db4"
   }
 }

package/pi-extension/index.ts

@@ -82,7 +82,10 @@ function debug(msg: string): void {
  * NOT used for `tool_call`, `user_bash`, `input` or `agent_end`: those four
  * consume the decision, and blocking is what enforcement means.
  */
-function forwardPolicy(eventName: string, payload: unknown): void {
+function forwardPolicy(
+  eventName: string,
+  payload: unknown,
+): void {
   const { cmd, args } = resolveSpawn();
   debug(`forwardPolicy (detached) event=${eventName} cmd=${cmd}`);
   try {
@@ -95,8 +98,8 @@ function forwardPolicy(eventName: string, payload: unknown): void {
     child.unref();
     // EPIPE if the child died before stdin was consumed — fail-open, silently.
     child.on("error", (err) => debug(`forward error ${err.message}`));
-    child.stdin.on("error", () => {});
-    child.stdin.end(JSON.stringify(payload));
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(JSON.stringify(payload));
   } catch (err) {
     debug(`FORWARD EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -121,8 +124,12 @@ function callPolicy(eventName: string, payload: unknown): { block: boolean; reas
     const parsed = JSON.parse(stdout) as PolicyDecision;
     if (parsed.permission === "deny") {
       debug(`DENY reason=${parsed.reason}`);
-      return { block: true, reason: parsed.reason ?? "Blocked by failproofai" };
+      return {
+        block: true,
+        reason: parsed.reason ?? "Blocked by failproofai",
+      };
     }
+    return { block: false, reason: "" };
   } catch (err) {
     debug(`EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
     // Fail-open: never block tool execution because of an infra failure.

package/src/audit/cache.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, openSync
 import { join } from "node:path";
 import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
 import { AUDIT_DETECTORS } from "./detectors";
+import { LEAK_SCAN_VERSION } from "./leak-scan";
 import type { TranscriptAuditResult, DetectorSessionState } from "./types";
 import { auditCacheDir } from "../hooks/fp-home";
 
@@ -162,6 +163,9 @@ interface CacheEntry {
   sizeBytes: number;
   engineVersion: string;
   detectorVersion: string;
+  /** Separate because leak detection is neither a builtin policy nor one of
+   * the behavioural AUDIT_DETECTORS hashed above. */
+  leakScanVersion: number;
   result: TranscriptAuditResult;
   /**
    * How far into the file the recorded result actually accounts for, at a LINE
@@ -269,6 +273,7 @@ export function readCachedTranscript(
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
     if (entry.engineVersion !== getEngineVersion()) return null;
     if (entry.detectorVersion !== getDetectorVersion()) return null;
+    if (entry.leakScanVersion !== LEAK_SCAN_VERSION) return null;
     // Number.isFinite (not typeof) so a malformed JSON `Infinity` /
     // `NaN` is rejected — those would otherwise bypass the TTL check
     // and pin a stale entry as valid forever.
@@ -332,6 +337,7 @@ export function writeCachedTranscriptResult(
       sizeBytes,
       engineVersion: getEngineVersion(),
       detectorVersion: getDetectorVersion(),
+      leakScanVersion: LEAK_SCAN_VERSION,
       result,
     };
     if (resume && resume.bytesScanned > 0) {

package/src/audit/cli-adapters/claude.ts

@@ -6,6 +6,7 @@
  * parses each via lib/log-entries.ts.
  */
 import { readFile, open, type FileHandle } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import {
   listClaudeProjects,
   listClaudeTranscripts,
@@ -40,6 +41,17 @@ export async function listClaudeTranscriptMetadata(
     }
     for (const t of transcripts) {
       if (t.mtimeMs < sinceMs) continue;
+      let sessionDescription: string | undefined;
+      if (t.isSubagent) {
+        try {
+          const meta = JSON.parse(
+            readFileSync(t.transcriptPath.replace(/\.jsonl$/, ".meta.json"), "utf8"),
+          ) as { description?: unknown };
+          if (typeof meta.description === "string") sessionDescription = meta.description;
+        } catch {
+          // Sidecars are optional (journal transcripts do not have one).
+        }
+      }
       out.push({
         cli: "claude",
         projectName: project.name,
@@ -47,6 +59,7 @@ export async function listClaudeTranscriptMetadata(
         transcriptPath: t.transcriptPath,
         mtimeMs: t.mtimeMs,
         sizeBytes: t.sizeBytes,
+        sessionDescription,
       });
     }
   }

package/src/audit/cli-login.ts

@@ -173,7 +173,10 @@ export async function ensureSignedIn(preset?: string): Promise<EnsureSignedIn> {
     throw new LoginError(
       "Signing in needs an interactive terminal, and this one is not.\n" +
         "Run `failproofai audit --schedule` from a shell you are sitting at,\n" +
-        "or sign in from the dashboard — both write the same session file.",
+        "or sign in from the dashboard — both write the same session file.\n" +
+        "\n" +
+        "`--email` does not avoid this: it fills in the address so you are not\n" +
+        "asked for it, but a one-time code is still sent there for you to paste.",
     );
   }