failproofai 1.0.4-beta.2 → 1.0.4-beta.6

package/src/audit/leak-scan.ts

@@ -24,18 +24,26 @@
  * them apart so the report can tell a user which of the two happened.
  */
 import { SECRET_PATTERNS } from "../hooks/builtin-policies";
-import { isSecretName } from "./redact-example";
+
+/**
+ * Cache key for the credential detector.
+ *
+ * The transcript cache used to key only on builtin policies and behavioural
+ * audit detectors. Changing THIS scanner therefore kept serving the old
+ * `result.leaks` forever, which made a precision fix appear to do nothing on a
+ * warm machine. Bump this whenever matching or suppression semantics change.
+ */
+export const LEAK_SCAN_VERSION = 6;
 
 /** One credential value found in one event. */
 export interface SecretMatch {
   /** The raw value. Held in memory only — the caller fingerprints it and must
    *  never persist or transmit this. */
   value: string;
-  /** The identifier it was assigned to, when it came from an assignment. For
-   *  the first-party class (230 of 237 secret-named assignments match no vendor
-   *  pattern) this is the only actionable label there is. */
+  /** The identifier it was assigned to, when a recognized shaped value also
+   *  appeared in an assignment. Used only as an actionable label. */
   name: string | null;
-  /** Which rule found it — a vendor label, or "assigned secret". */
+  /** Which recognizable credential shape found it. */
   rule: string;
   /** Whether the value carried a recognised vendor shape. Drives the record's
    *  confidence, and therefore whether an alert may name a console. */
@@ -69,36 +77,6 @@ export interface SecretMatch {
 const ASSIGNMENT_RE =
   /(["']?)\b([A-Za-z_][A-Za-z0-9_]{0,127})\1([ \t]*(?::(?!\/\/)|=)[ \t]*)("[^"]*"|'[^']*'|[^\s;|&"']+)/g;
 
-/** Shortest value worth reporting. Below this it is a flag, a boolean or a
- *  placeholder far more often than a credential. */
-const MIN_VALUE_LEN = 8;
-
-/**
- * Values that are structurally incapable of being a leaked credential.
- *
- * Deliberately structural, never entropy: the corpus's one confirmed-live
- * password measures 3.19 bits per character while 1.3 million UUIDs in the same
- * corpus sit at 3.72, so any entropy threshold that catches the password also
- * catches every UUID. These tests are decisive instead — a `$VAR` reference
- * contains no secret by construction, and `process.env.X` is the CORRECT secure
- * form, which the redactor currently flags 7,870 times.
- */
-function isNotACredential(value: string): boolean {
-  if (value.length < MIN_VALUE_LEN) return true;
-  // Shell/template indirection: the value is a reference, not a secret.
-  if (/^[$<{(`%]/.test(value)) return true;
-  if (value.includes("${") || value.includes("{{") || value.includes("%(")) return true;
-  // A code expression — `process.env.DISCORD_TOKEN` is how you SHOULD do it.
-  if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(value)) return true;
-  // Already masked, by us or by anyone else.
-  if (value.includes("[REDACTED") || /^[•*#.]+$/.test(value)) return true;
-  if (/(.)\1{5,}/.test(value)) return true;          // xxxxxxxx, 00000000
-  if (/^(true|false|null|undefined|none)$/i.test(value)) return true;
-  if (/^-?\d+(\.\d+)?$/.test(value)) return true;    // pure number
-  if (/^\/|^~\/|^\.\.?\//.test(value)) return true;  // a path
-  return false;
-}
-
 /** Strip one layer of surrounding quotes. */
 function unquote(v: string): string {
   return (v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))
@@ -249,19 +227,17 @@ export function findSecrets(text: string): SecretMatch[] {
     }
   }
 
+  // Names annotate a value the shape layer already proved; they no longer
+  // create findings. Even after increasingly elaborate value heuristics, the
+  // name-only lane still produced hundreds of code literals and test fixtures
+  // on the measured machine. The product now deliberately prefers missing an
+  // unrecognisable first-party password over telling somebody they leaked 500
+  // credentials they do not have.
   for (const m of text.matchAll(ASSIGNMENT_RE)) {
     const name = m[2];
     const value = unquote(m[4]);
-    if (!isSecretName(name) || isNotACredential(value) || isDocsLiteral(value)) continue;
     const existing = byValue.get(value);
-    if (existing) {
-      // A vendor-shaped value that also has a name: keep the vendor rule (it
-      // can name a console) and gain the name (it says which of the user's
-      // variables to change).
-      existing.name ??= name;
-      continue;
-    }
-    byValue.set(value, { value, name, rule: "assigned secret", shaped: false });
+    if (existing) existing.name ??= name;
   }
 
   return [...byValue.values()];

package/src/audit/leak-store.ts

@@ -74,7 +74,10 @@ function readJson<T>(path: string): T | null {
 export function readLeakIdentity(home?: string): LeakIdentity {
   const existing = readJson<Partial<LeakIdentity>>(auditLeakIdentityFile(home));
   if (existing && typeof existing.salt === "string" && existing.salt.length >= 32) {
-    return { salt: existing.salt, dismissed: existing.dismissed ?? [] };
+    return {
+      salt: existing.salt,
+      dismissed: existing.dismissed ?? [],
+    };
   }
   const minted: LeakIdentity = { salt: randomBytes(32).toString("hex"), dismissed: [] };
   writeLeakIdentity(minted, home);
@@ -121,7 +124,7 @@ export function writeLeakIdentity(identity: LeakIdentity, home?: string): boolea
 function sanitizeFinding(raw: unknown): LeakFinding | null {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const f = raw as Record<string, unknown>;
-  // The id becomes a FILENAME (notice markers, the macOS queue), so anything
+  // The id becomes a filename in the macOS notification queue, so anything
   // that is not the exact minted shape disqualifies the whole entry.
   if (typeof f.id !== "string" || !isFindingId(f.id)) return null;
 

package/src/audit/machine-store.ts

@@ -7,9 +7,8 @@
  *  - `machine_id` is what the api-server keys reports on. Regenerate it and the
  *    server sees a brand-new machine, which burns a slot off the account's cap
  *    on every logout and splits one box's history into two.
- *  - `last_reported_at` is how far the last digest reached. Reset it and the
- *    next report re-covers months of history, and the user gets a digest of
- *    everything that ever happened as though it just did.
+ *  - `last_reported_at` is how far the last credential alert reached. Reset it
+ *    and the next report can re-cover old exposures as though they just happened.
  *
  * That is why this is a separate file from `session.json` rather than two more
  * keys in it: signing out deletes the session, and neither of these may go with
@@ -22,7 +21,7 @@
  * `state/telemetry-id` is already a stable per-machine random id and would have
  * been free to reuse. It is deliberately not reused: that id is the anonymous
  * PostHog person, and sending it alongside a verified email address would link
- * the two the moment somebody turns emailed reports on. Opting into a digest
+ * the two the moment somebody adds email alerts. Opting into email
  * should not de-anonymise telemetry, so this feature gets its own id and the
  * two never meet.
  */
@@ -66,8 +65,8 @@ export function readMachineIdentity(home?: string): MachineIdentity | null {
 /**
  * Read the identity, creating it on first call.
  *
- * Only ever called from the reporting path, so a machine that never opts into
- * emailed reports never gets an id at all — there is nothing to mint one for.
+ * Only ever called from the email-reporting path, so a machine without a valid
+ * email identity never gets an id at all — there is nothing to mint one for.
  */
 export function ensureMachineIdentity(home?: string): MachineIdentity {
   const existing = readMachineIdentity(home);
@@ -81,13 +80,13 @@ export function ensureMachineIdentity(home?: string): MachineIdentity {
 }
 
 /**
- * Record how far the last DELIVERED digest reached.
+ * Record how far the last delivered credential alert reached.
  *
  * The value is the server's `next_window_from`, not the window this run
  * scanned. The server is authoritative because it knows which reports actually
  * produced an email — a report held by the cooldown, or one whose send failed,
  * must not advance the watermark or its findings are silently dropped from every
- * future digest.
+ * future alert.
  */
 export function recordReportWatermark(nextWindowFrom: string, home?: string): void {
   const current = ensureMachineIdentity(home);
@@ -105,7 +104,7 @@ export function deleteMachineIdentity(home?: string): void {
 /**
  * A display name for this machine — its hostname.
  *
- * Shown in the digest so somebody with three boxes can tell which one is
+ * Shown in the email alert so somebody with three boxes can tell which one is
  * misbehaving, which is the whole reason it is sent. Falls back to `undefined`
  * rather than a placeholder: the server keeps whatever label it already has when
  * one is omitted, so guessing here would overwrite a good name with a bad one.

package/src/audit/macos-notifier.ts

@@ -255,8 +255,8 @@ export function queueMacNotification(
   body: string,
   home?: string,
 ): boolean {
-  // The id becomes a filename in a watched directory. Same guard, same reason
-  // as `markLeakNoticeDelivered` — see `isFindingId`.
+  // The id becomes a filename in a watched directory, so validate the path
+  // component before resolving it — see `isFindingId`.
   if (!isFindingId(id)) return false;
   const dir = macNotifyDir(home);
   const tmp = resolve(dir, "..", `notify-${id}.tmp`);

package/src/audit/redact-example.ts

@@ -147,14 +147,40 @@ const SECRET_NAME_SUBSTRINGS = [
   "APIKEY",
   "PRIVATEKEY",
 ];
-const SECRET_NAME_COMPONENTS = ["KEY", "PASS", "AUTH", "PAT", "SIG", "SIGNATURE", "SESSION", "COOKIE"];
+const SECRET_NAME_COMPONENTS = ["PASS", "AUTH", "PAT", "SIG", "SIGNATURE", "COOKIE"];
 
 /**
- * `PWD` names a credential only in a COMPOUND identifier. `MYSQL_PWD` is
- * MySQL's documented password variable; a bare `PWD` is the shell's working
- * directory, which is on every second line of a captured session.
+ * Names that mean "credential" only inside a COMPOUND identifier.
+ *
+ * Every entry here was measured as a dominant false positive on a real 2,664-
+ * transcript corpus, and the reason they are demotions rather than deletions is
+ * that the SHAPE layer already catches real vendor keys regardless of what they
+ * are called. The name layer exists for FIRST-PARTY secrets with no recognisable
+ * format — and those essentially always carry a qualified name
+ * (`COMPOSIO_API_KEY`, `DB_PASSWORD`), never a bare one. So requiring a compound
+ * costs almost nothing real and removes most of the noise.
+ *
+ *   PWD      `MYSQL_PWD` is MySQL's documented password variable; a bare `PWD`
+ *            is the shell's working directory, on every second line of a
+ *            captured session.
+ *   KEY      a bare `key=` is a React list prop, a map entry, a sort field.
+ *            80 findings on the measured corpus, none of them credentials.
+ *
+ * `SIG` was demoted here too and put back: a bare `sig=` in a URL query IS a
+ * request signature, and an existing test says so. It also never appeared in
+ * the measured noise, unlike the two above — the rule is that a demotion needs
+ * evidence, not a plausible story.
+ *
+ * `SESSION` is REMOVED from both lists rather than demoted, and the difference
+ * matters: demoting it would have changed nothing, because
+ * `DBUS_SESSION_BUS_ADDRESS` is already a compound. It was the single largest
+ * source of noise measured — 254 of 500 findings, every one of them
+ * `DBUS_SESSION_BUS_ADDRESS`, `XDG_SESSION_TYPE`, `SESSION_MANAGER`,
+ * `session_id` or `sessionUpdate`. A session IDENTIFIER is not a rotatable
+ * credential; a session SECRET still matches through `SECRET`, `TOKEN`, or
+ * `KEY` in `sessionKey`.
  */
-const COMPOUND_ONLY_COMPONENTS = ["PWD"];
+const COMPOUND_ONLY_COMPONENTS = ["PWD", "KEY"];
 
 /**
  * Split an identifier into its uppercased components, on `_`, `-`, `.` AND
@@ -300,6 +326,35 @@ export function isPublishedByDesign(name: string): boolean {
   return PUBLISHED_MARKERS.test(upper);
 }
 
+/**
+ * How confidently the NAME alone says "credential".
+ *
+ * `strong` — the word means secret and nothing else: `DB_PASSWORD`,
+ * `STRIPE_SECRET`, `PRIVATE_KEY`. A short value here is still worth flagging;
+ * `hunter2` assigned to `PASSWORD` is a leaked password.
+ *
+ * `weak` — the word is ALSO ordinary programming vocabulary: `key`, `token`,
+ * `auth`, `sig`. Measured on a real 2,664-transcript machine these produced
+ * `keyType`, `tokenLimitCancelled`, `max_output_tokens`, `resultKey`,
+ * `configDirKey` — 394 findings from this layer, of which 389 had no vendor
+ * prefix and 227 were under 24 characters. Nothing that short is an API key.
+ * A weak name has to be backed by a value that actually looks like a secret.
+ */
+export type SecretNameStrength = "strong" | "weak" | "none";
+
+const STRONG_NAME_WORDS = ["SECRET", "PASSWORD", "PASSWD", "PASSPHRASE", "CREDENTIAL", "APIKEY", "PRIVATEKEY"];
+
+export function secretNameStrength(name: string): SecretNameStrength {
+  if (!isSecretName(name)) return "none";
+  const upper = name.toUpperCase();
+  if (STRONG_NAME_WORDS.some((w) => upper.includes(w))) return "strong";
+  // `API_KEY` / `apiKey` split into components rather than matching APIKEY as a
+  // substring, and they are as unambiguous as the substring form.
+  const parts = identifierComponents(name);
+  if (parts.includes("API") && parts.includes("KEY")) return "strong";
+  return "weak";
+}
+
 export function isSecretName(name: string): boolean {
   // Runs first and beats every other signal: a value the framework compiles
   // into the browser bundle is public no matter what the rest of the name says.
@@ -518,6 +573,7 @@ export function redactAuditResult(result: AuditResult, home = homedir()): AuditR
     // Salted, machine-local ids. They carry no path and cannot be reversed to
     // a credential, so they pass through — but the decision is recorded here
     // rather than inherited from a spread.
+    leakIds: result.leakIds,
     newLeakIds: result.newLeakIds,
 
     // Everything below carries a path or user content and is rewritten.
@@ -560,5 +616,6 @@ export const REDACTED_AUDIT_RESULT_KEYS: ReadonlyArray<keyof AuditResult> = [
   "projectsScanned",
   "eventsScanned",
   "enabledBuiltinNames",
+  "leakIds",
   "newLeakIds",
 ];

package/src/audit/report-harm.ts

@@ -1,6 +1,6 @@
 /**
- * The side effect a scheduled audit has that no other audit does: telling the
- * api-server what it found, so a harm digest can be mailed.
+ * The optional remote side effect of a scheduled audit: telling the api-server
+ * about the newest masked credential exposure so an email alert can be sent.
  *
  * Separated from `harm-report.ts` on purpose. That module is pure — result in,
  * payload out — and is where the windowing rules live and are tested. This one
@@ -15,7 +15,7 @@
  * token expired, whose network is down, or whose api-server is having a bad day
  * must keep auditing itself locally and keep showing results on its own
  * dashboard — the local feature does not depend on the remote one, and a person
- * who never enabled emailed reports must never be able to tell this code exists.
+ * who never added an email must never have the local scan depend on this code.
  *
  * ## Why the CHILD does this and not the daemon
  *
@@ -35,6 +35,7 @@ import { activeFindings, readLeakRecord } from "./leak-store";
 import {
   ensureMachineIdentity,
   machineLabel,
+  readMachineIdentity,
   recordReportWatermark,
 } from "./machine-store";
 import type { AuditResult } from "./types";
@@ -42,31 +43,26 @@ import type { AuditResult } from "./types";
 /** What happened, for the one line the scheduled run prints. */
 export type HarmReportOutcome =
   | { kind: "disabled" }
-  | { kind: "consent-required" }
+  | { kind: "no-leak" }
   | { kind: "signed-out" }
-  | { kind: "sent"; hits: number }
-  | { kind: "held"; hits: number; reason: string }
+  | { kind: "sent"; leaks: number }
+  | { kind: "held"; leaks: number; reason: string }
   | { kind: "failed"; error: string };
 
 /**
- * Report this scan's harmful findings, if the user asked for that.
+ * Report this scan's newest credential exposure when an email identity exists.
  *
  * Returns an outcome rather than a boolean so the caller can say something
- * truthful. "held" in particular is not a failure — a machine below the
- * threshold, or inside its cooldown, is working exactly as intended, and a line
- * that called that an error would train people to ignore the line.
+ * truthful. "held" in particular is not a failure — a machine inside its
+ * cooldown is working exactly as intended, and a line that called that an error
+ * would train people to ignore the line.
  */
 export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome> {
-  // ONE switch. `auto` means "scan on a timer AND tell me", because the reason
-  // to put a scan on a timer is to be told — a machine scanning quietly with
-  // nothing to report to is a feature that looks on and does nothing visible.
   let auto = false;
-  let consentedAt: number | undefined;
   let intervalDays = 7;
   try {
     const config = readConfig();
     auto = config.audit.auto;
-    consentedAt = config.audit.reportsConsentedAt;
     // Also the width of a FIRST report's window, so a new machine's opening
     // digest covers the same period every later one will.
     intervalDays = config.audit.intervalDays;
@@ -76,13 +72,18 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
   }
   if (!auto) return { kind: "disabled" };
 
-  // `auto` alone is not consent to SEND, on a machine that set it before this
-  // existed. Through 1.0.0 that key meant "scan locally on a timer" — no
-  // account, no network, and the toggle that wrote it said so. Sending is
-  // gated on the separate stamp every current opt-in path writes, so a
-  // machine upgrading into this release keeps scanning and mails nothing until
-  // a person opts in again and sees what that sends. See `audit.reportsConsentedAt`.
-  if (consentedAt === undefined) return { kind: "consent-required" };
+  // Decide whether there is anything emailable before touching auth or the
+  // network. Scheduled scans are local by default; an email identity is an
+  // optional delivery channel, and a scan with no credential leak must make no
+  // report request at all.
+  const prior = readMachineIdentity();
+  const report = buildHarmReport(
+    result,
+    prior?.last_reported_at,
+    intervalDays,
+    activeFindings(readLeakRecord()),
+  );
+  if (report.leaks.length === 0) return { kind: "no-leak" };
 
   const auth = await getValidAccessToken();
   if (!auth) {
@@ -102,18 +103,6 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     return { kind: "failed", error: err instanceof Error ? err.message : String(err) };
   }
 
-  // The leak record is read here rather than carried on the AuditResult: the
-  // digest wants every credential still live in this window, not only the ones
-  // this particular scan happened to re-encounter. A key that leaked last month
-  // and was not touched by today's transcripts is still a key to rotate.
-  const report = buildHarmReport(
-    result,
-    identity.last_reported_at,
-    intervalDays,
-    activeFindings(readLeakRecord()),
-  );
-  const hits = report.harmful.reduce((n, p) => n + p.hits, 0);
-
   try {
     const res = await submitAuditReport(auth.access_token, {
       machine_id: identity.machine_id,
@@ -139,8 +128,8 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     }
 
     return res.emailed
-      ? { kind: "sent", hits }
-      : { kind: "held", hits, reason: res.reason ?? "not_sent" };
+      ? { kind: "sent", leaks: report.leaks.length }
+      : { kind: "held", leaks: report.leaks.length, reason: res.reason ?? "not_sent" };
   } catch (err) {
     // A 401 here means the session died between `getValidAccessToken` and this
     // call — rare, and indistinguishable from any other failure as far as this
@@ -160,19 +149,15 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
 export function describeOutcome(outcome: HarmReportOutcome): string | null {
   switch (outcome.kind) {
     case "disabled":
-      return null; // Say nothing at all to the majority who never opted in.
-    case "consent-required":
-      return "failproofai: scheduled scans are on, but emailing what they find needs a fresh opt-in — run `failproofai audit --schedule` (or visit /settings) to turn digests on";
+    case "no-leak":
+      return null;
     case "signed-out":
-      // Names the two places that can actually fix it. It used to say "sign in
-      // from the audit page", which stopped being true when this release moved
-      // that dialog behind "invite a friend".
-      return "failproofai: emailed reports are on but this machine is signed out — run `failproofai audit --schedule` or visit /settings to resume them";
+      return "failproofai: a credential exposure was found, but no email is configured — run `failproofai audit --schedule --email you@example.com`";
     case "sent":
-      return `failproofai: emailed a harm digest (${outcome.hits} finding${outcome.hits === 1 ? "" : "s"})`;
+      return "failproofai: emailed the most recent credential exposure";
     case "held":
-      return `failproofai: ${outcome.hits} finding${outcome.hits === 1 ? "" : "s"} reported, no email (${outcome.reason})`;
+      return `failproofai: credential exposure reported, no email (${outcome.reason})`;
     case "failed":
-      return `failproofai: could not send the harm report: ${outcome.error}`;
+      return `failproofai: could not send the credential alert: ${outcome.error}`;
   }
 }

package/src/audit/schedule-cli.ts

@@ -68,13 +68,9 @@ const dim = (s: string) => wrap(ANSI_DIM, s);
 const bold = (s: string) => wrap(ANSI_BOLD, s);
 
 /**
- * Turn scheduled audits on, signing in first if needed.
- *
- * Scheduling and mailing are ONE decision — the reason to put a scan on a timer
- * is to be told what it found — so this requires a session, exactly as the
- * dashboard's `setAutoAuditAction` does. A timer set with nobody to tell is a
- * switch that reads as on and produces nothing, discoverable only by noticing
- * that no digest ever arrives.
+ * Turn scheduled audits on. Email is optional: `--email` signs in, while a
+ * plain `--schedule` enables the local scan and desktop notification without
+ * prompting for an account.
  *
  * The interval is written and then RE-READ, so what is printed is what the
  * config actually kept — `readIntervalDays` owns the 1..90 clamp and a second
@@ -108,17 +104,13 @@ export async function runScheduleOn(
     if (bad) throw new ScheduleCliError(bad);
   }
 
-  const { user, prompted } = await ensureSignedIn(emailArg);
+  const signedIn = emailArg === undefined
+    ? { user: readAuth()?.user ?? null, prompted: false }
+    : await ensureSignedIn(emailArg);
 
   const next = updateConfig({
-    // Stamped in the SAME call that sets `auto`, never separately: this records
-    // that a person completed a sign-in and read the disclosure printed below,
-    // and it is what `reportHarm` gates sending on. A machine that inherited
-    // `auto` from a release where it meant "scan locally" has no stamp and
-    // sends nothing until it comes through here.
     audit: {
       auto: true,
-      reportsConsentedAt: Date.now(),
       ...(days !== undefined ? { intervalDays: days } : {}),
     },
   });
@@ -134,12 +126,14 @@ export async function runScheduleOn(
   // The list is the real payload from `report-harm.ts`: machine id, hostname,
   // platform, the window bounds and the redacted examples.
   const summary = [
-    `every ${interval} day${interval === 1 ? "" : "s"} · reports to ${user.email}`,
-    "you only hear from it when a scan finds something harmful",
-    "each report sends: finding counts, redacted example commands, this machine's name",
+    `every ${interval} day${interval === 1 ? "" : "s"} · desktop notification on leaks`,
+    signedIn.user
+      ? `masked leak alerts also go to ${signedIn.user.email}`
+      : "email is optional · add it with --email you@example.com",
+    "email contains only the most recent masked credential exposure",
   ];
 
-  if (prompted) {
+  if (signedIn.prompted) {
     // A sign-in just drew the frame, so the result continues it and the `└`
     // closes both at once — rather than the frame ending and a loose line
     // appearing underneath.
@@ -158,7 +152,7 @@ export async function runScheduleOn(
   // exists to make visible.
   warnIfDaemonWontRun();
 
-  if (prompted) {
+  if (signedIn.prompted) {
     outro("failproofai audit --status  ·  when the next scan is due");
   } else {
     process.stdout.write(dim(`\n   failproofai audit --status   when the next scan is due\n\n`));
@@ -217,7 +211,7 @@ export function runScheduleStatus(): void {
 
   // A session whose refresh window has closed cannot mint another access token,
   // so it is a destination in name only. Showing the address for one would tell
-  // somebody their digests are going somewhere they are not.
+  // somebody their alerts are going somewhere they are not.
   const live = auth && auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
   // Beside the schedule, because they are the two halves of "what does this
   // machine do on its own" — one decides whether it scans, the other whether it
@@ -230,19 +224,9 @@ export function runScheduleStatus(): void {
   detail.push(["reports to", live ? live.user.email : dim("— signed out")]);
   if (on && !live) {
     // The state the reporter surfaces as "signed-out". Named here for the same
-    // reason the settings panel names it: the scans keep running, so silence
-    // about the digests would look like the feature failing.
-    detail.push(["", pink("scans continue; digests are paused until you sign in")]);
-  } else if (on && config.audit.reportsConsentedAt === undefined) {
-    // Signed in, scheduled, and still not sending: this machine set `audit.auto`
-    // when it only meant "scan locally", so nothing has consented to the digest
-    // leaving the box. Without this row the status screen would show a healthy
-    // schedule and a live address and still mail nothing, with no explanation
-    // anywhere the user can see.
-    detail.push([
-      "",
-      pink("scans continue; digests need a fresh opt-in — run `--schedule` to turn them on"),
-    ]);
+    // reason the settings panel names it: the scans and desktop notifications
+    // keep running, so silence about email would look like the feature failing.
+    detail.push(["", pink("scans and desktop alerts continue; email alerts are paused")]);
   }
 
   detail.push(["daemon", describeDaemon(daemon)]);

package/src/audit/types.ts

@@ -45,6 +45,9 @@ export interface TranscriptMetadata {
   mtimeMs: number;
   /** Byte size of the transcript file. Used for cache invalidation. */
   sizeBytes: number;
+  /** Optional host-authored session purpose. Used only to distinguish
+   * deliberate credential-scanner research from evidence of a leak. */
+  sessionDescription?: string;
 }
 
 /** Per-session detector state. Detectors mutate this freely. */
@@ -172,6 +175,9 @@ export interface TranscriptAuditResult {
    * absent reads as "this transcript predates leak scanning", not "clean".
    */
   leaks?: TranscriptLeak[];
+  /** The session was explicitly generating/researching credential fixtures,
+   * so its matches are examples rather than evidence of user leakage. */
+  leakScanSuppressed?: "credential-research";
   /** First/last timestamp per name. */
   rangeByName: Record<string, { first: string; last: string }>;
 }
@@ -211,6 +217,11 @@ export interface AuditResult {
    *  Lets the dashboard answer "is this policy already on?" for
    *  detector-mapped policies that may not have hit during this audit. */
   enabledBuiltinNames: string[];
+  /** Ids of credentials encountered by this scan, including ones already in
+   *  the persistent leak record. Scheduled desktop notifications key on this
+   *  list so every completed scan that still sees a leak can notify; the
+   *  narrower `newLeakIds` remains for first-seen-only surfaces. */
+  leakIds?: string[];
   /**
    * Ids of credentials seen for the FIRST time in this scan.
    *

package/src/hooks/configure-wizard.ts

@@ -106,6 +106,7 @@ import {
   type RetryProbe,
 } from "./onboarding-attempt";
 import { acquireOnboardingLock } from "./onboarding-lock";
+import { readConfigRaw, updateConfig } from "./fp-config";
 
 export interface WizardIO {
   stdin?: TTYIn;
@@ -755,6 +756,19 @@ export async function runConfigureWizard(
   // question, and no flag can supply it.
   const preAnswered = Boolean(answers.token);
 
+  // Capture the preference BEFORE the daemon setup writes config.json. A fresh
+  // machine reaches `setDaemonConfigured(true)` with no config file; that helper
+  // necessarily materialises the conservative no-file default (`auto: false`).
+  // Looking after that write cannot distinguish "the user switched it off"
+  // from "setup just wrote its fallback", which is how new installs ended up
+  // with a seven-day scheduler that was explicitly disabled.
+  const initialAudit = readConfigRaw().raw.audit;
+  const hadExplicitAuditAuto =
+    !!initialAudit &&
+    typeof initialAudit === "object" &&
+    !Array.isArray(initialAudit) &&
+    typeof (initialAudit as Record<string, unknown>).auto === "boolean";
+
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
   // does it silently: homedir() becomes /root, so the hooks land in root's
@@ -1439,6 +1453,20 @@ export async function runConfigureWizard(
   // binary filename are both derived from it.
   if (daemonInstalled) {
     setDaemonConfigured(true, cliVersion);
+    // A completed setup is the default opt-in to the LOCAL seven-day scan. It
+    // does not imply an email address or make a network request: reporting is
+    // independently gated by the signed-in audit identity. Reconfiguration
+    // preserves an explicit `auto: false`, so the user's off switch remains an
+    // off switch instead of being undone whenever they repair or upgrade the
+    // daemon.
+    if (!hadExplicitAuditAuto) {
+      try {
+        updateConfig({ audit: { auto: true } });
+      } catch {
+        // The daemon and hooks are already installed. Keep setup successful;
+        // the status screen will expose that scheduling could not be persisted.
+      }
+    }
     // Only now — the unit points at the new binary, so older ones are no
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.