failproofai 1.0.4-beta.4 → 1.0.4-beta.6

package/lib/auth/api-server-client.ts

@@ -257,7 +257,7 @@ export interface AuditReportBody {
    * Credentials this machine found in its own transcripts.
    *
    * Optional on the wire, so a CLI newer than the api-server sends a field the
-   * server ignores rather than failing the whole digest — the harmful counts
+   * server ignores rather than failing the whole report — the harmful counts
    * are the older half of the contract and must keep arriving either way.
    *
    * Every field here is a mask, a label, a length or a location. There is no
@@ -287,15 +287,15 @@ export interface AuditReportResult {
   report_id: string;
   /** Whether this report produced an email. */
   emailed: boolean;
-  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
+  /** `no_leak`, `cooldown`, `send_failed`, or null when mail went out. */
   reason: string | null;
   /**
    * Where the next window starts, per the SERVER.
    *
    * Persisted verbatim rather than computed locally. The server anchors it on
-   * the last DELIVERED digest, so a report held by the cooldown — or one whose
+   * the last DELIVERED alert, so a report held by the cooldown — or one whose
    * send failed — correctly leaves the watermark where it was, and its findings
-   * turn up in the next digest instead of falling into a gap. A machine that
+   * turn up in the next alert instead of falling into a gap. A machine that
    * lost `machine.json` also resyncs here rather than re-reporting from the
    * beginning of time.
    */
@@ -303,11 +303,11 @@ export interface AuditReportResult {
 }
 
 /**
- * Submit one scheduled scan's harmful findings.
+ * Submit one scheduled scan's harmful findings and newest masked credential.
  *
  * Called only by the audit child, and only on `--scheduled`. The destination
  * address is never sent: the api-server takes it from the access-token claims,
- * so a report cannot name where its digest goes.
+ * so a report cannot name where its email alert goes.
  */
 export async function submitAuditReport(
   accessToken: string,

package/lib/codex-sessions.ts

@@ -158,6 +158,21 @@ function joinTexts(blocks: CodexContentBlock[] | undefined, wantedType: "input_t
     .join("\n");
 }
 
+/** Text carried by tool outputs. Newer Codex chronicles use an array of
+ * `input_text` blocks for `custom_tool_call_output`, while older releases use
+ * one string for `function_call_output`. */
+function toolOutputText(output: unknown): string {
+  if (typeof output === "string") return output;
+  if (Array.isArray(output)) {
+    return output
+      .filter((block): block is CodexContentBlock => !!block && typeof block === "object")
+      .map((block) => typeof block.text === "string" ? block.text : "")
+      .filter(Boolean)
+      .join("\n");
+  }
+  return output === undefined ? "" : JSON.stringify(output);
+}
+
 /**
  * Parse a Codex JSONL transcript into `LogEntry[]` plus the raw lines.
  * Yields to the event loop every 200 lines so big transcripts don't block.
@@ -250,10 +265,11 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call") {
+      if (subType === "function_call" || subType === "custom_tool_call") {
         const callId = payload.call_id as string | undefined;
         const name = (payload.name as string | undefined) ?? "function_call";
-        const input = safeJsonParse(payload.arguments as string | undefined);
+        const encodedInput = (payload.arguments ?? payload.input) as string | undefined;
+        const input = safeJsonParse(encodedInput);
         const toolUse: ToolUseBlock = {
           type: "tool_use",
           id: callId ?? `${timestamp}-${name}`,
@@ -273,7 +289,7 @@ export async function parseCodexLog(
         continue;
       }
 
-      if (subType === "function_call_output") {
+      if (subType === "function_call_output" || subType === "custom_tool_call_output") {
         const callId = payload.call_id as string | undefined;
         const block = callId ? toolUseById.get(callId) : undefined;
         if (block) {
@@ -282,7 +298,7 @@ export async function parseCodexLog(
           block.result = {
             timestamp,
             timestampFormatted: formatTimestamp(date),
-            content: typeof payload.output === "string" ? (payload.output as string) : JSON.stringify(payload.output),
+            content: toolOutputText(payload.output),
             durationMs: duration,
             durationFormatted: formatDuration(duration),
           };

package/lib/copilot-sessions.ts

@@ -151,6 +151,11 @@ interface CopilotToolResult {
   detailedContent?: string;
 }
 
+interface CopilotHookToolResult {
+  textResultForLlm?: string;
+  sessionLog?: string;
+}
+
 interface CopilotToolTelemetry {
   metrics?: { commandTimeMs?: number; durationMs?: number };
   properties?: Record<string, unknown>;
@@ -171,6 +176,8 @@ export async function parseCopilotLog(
   // toolCallId → tool_use block, so we can attach tool.execution_complete back.
   const toolUseById = new Map<string, ToolUseBlock>();
   const toolUseStartMs = new Map<string, number>();
+  let mostRecentToolUse: ToolUseBlock | undefined;
+  let mostRecentToolUseStartMs = 0;
   let cwd: string | undefined;
   let seenSessionStart = false;
 
@@ -273,9 +280,32 @@ export async function parseCopilotLog(
         toolUseById.set(callId, toolUse);
         toolUseStartMs.set(callId, date.getTime());
       }
+      mostRecentToolUse = toolUse;
+      mostRecentToolUseStartMs = date.getTime();
       continue;
     }
 
+    // Copilot CLI 1.0.39 can omit the command's real stdout from
+    // `tool.execution_complete` and expose it only to the PostToolUse hook as
+    // `input.toolResult.textResultForLlm`. That is the value the model saw and
+    // the value failproofai must audit. Keep it on the active tool block; the
+    // later completion record may still contribute timing, but must not replace
+    // this output with its shorter status-only summary.
+    if (recType === "hook.start" && data.hookType === "postToolUse" && mostRecentToolUse) {
+      const input = (data.input as Record<string, unknown> | undefined) ?? {};
+      const hookResult = (input.toolResult as CopilotHookToolResult | undefined) ?? {};
+      const hookContent = hookResult.textResultForLlm ?? hookResult.sessionLog;
+      if (typeof hookContent === "string" && hookContent.length > 0) {
+        mostRecentToolUse.result = {
+          timestamp,
+          timestampFormatted: formatTimestamp(date),
+          content: hookContent,
+          durationMs: Math.max(0, date.getTime() - mostRecentToolUseStartMs),
+          durationFormatted: formatDuration(Math.max(0, date.getTime() - mostRecentToolUseStartMs)),
+        };
+      }
+    }
+
     if (recType === "tool.execution_complete") {
       const callId = data.toolCallId as string | undefined;
       const block = callId ? toolUseById.get(callId) : undefined;
@@ -289,7 +319,8 @@ export async function parseCopilotLog(
           typeof reportedMs === "number" && reportedMs >= 0
             ? reportedMs
             : Math.max(0, date.getTime() - startMs);
-        const content = result.detailedContent ?? result.content ?? "";
+        const completionContent = result.detailedContent ?? result.content ?? "";
+        const content = block.result?.content || completionContent;
         block.result = {
           timestamp,
           timestampFormatted: formatTimestamp(date),

package/lib/cursor-sessions.ts

@@ -127,7 +127,15 @@ interface CursorRecord {
   /** Cursor 2026-04+ transcript shape: `{role, message: {content: [...]}}`. */
   role?: "user" | "assistant" | "system" | string;
   message?: {
-    content?: Array<{ type?: string; text?: string }>;
+    content?: Array<{
+      type?: string;
+      text?: string;
+      id?: string;
+      name?: string;
+      input?: Record<string, unknown>;
+      tool_use_id?: string;
+      content?: unknown;
+    }>;
   };
 }
 
@@ -183,11 +191,36 @@ export async function parseCursorLog(
     if (!raw.type && raw.role && raw.message?.content) {
       const synthDate = new Date(SYNTH_T0 + i);
       const synthTs = synthDate.toISOString();
-      const textParts = raw.message.content
+      const messageContent = raw.message.content;
+      const textParts = messageContent
         .filter((c) => c?.type === "text" && typeof c.text === "string")
         .map((c) => c.text!)
         .join("");
       if (raw.role === "user") {
+        // Some Cursor builds emit Claude-style tool_result blocks in the next
+        // user record. Pair them before treating any remaining text as a user
+        // turn so command output is available to the credential scanner.
+        let attachedResult = false;
+        for (const block of messageContent) {
+          if (block?.type !== "tool_result") continue;
+          const callId = typeof block.tool_use_id === "string" ? block.tool_use_id : undefined;
+          const toolUse = callId ? toolUseById.get(callId) : undefined;
+          if (!toolUse) continue;
+          const durationMs = Math.max(
+            0,
+            synthDate.getTime() - (toolUseStartMs.get(callId!) ?? synthDate.getTime()),
+          );
+          toolUse.result = {
+            timestamp: synthTs,
+            timestampFormatted: formatTimestamp(synthDate),
+            content: typeof block.content === "string"
+              ? block.content
+              : block.content == null ? "" : JSON.stringify(block.content),
+            durationMs,
+            durationFormatted: formatDuration(durationMs),
+          };
+          attachedResult = true;
+        }
         // Strip the synthesized `<timestamp>...</timestamp>\n<user_query>...\n</user_query>`
         // wrapper Cursor adds for context — keep just the user_query body.
         const queryMatch = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/.exec(textParts);
@@ -198,13 +231,37 @@ export async function parseCursorLog(
             ...baseEntry(rawCopy, synthTs, synthDate, source),
             message: { role: "user", content: text },
           } satisfies UserEntry);
+        } else if (!attachedResult) {
+          entries.push({
+            type: "system",
+            ...baseEntry(rawCopy, synthTs, synthDate, source),
+            raw: rawCopy,
+          } satisfies GenericEntry);
         }
         continue;
       }
       if (raw.role === "assistant") {
-        const blocks: ContentBlock[] = textParts
-          ? [{ type: "text", text: textParts }]
-          : [];
+        const blocks: ContentBlock[] = [];
+        if (textParts) blocks.push({ type: "text", text: textParts });
+        for (let j = 0; j < messageContent.length; j++) {
+          const contentBlock = messageContent[j];
+          if (contentBlock?.type !== "tool_use") continue;
+          const name = typeof contentBlock.name === "string" ? contentBlock.name : "tool";
+          const id = typeof contentBlock.id === "string" && contentBlock.id
+            ? contentBlock.id
+            : `cursor-${i}-${name}-${j}`;
+          const toolUse: ToolUseBlock = {
+            type: "tool_use",
+            id,
+            name,
+            input: contentBlock.input && typeof contentBlock.input === "object"
+              ? contentBlock.input
+              : {},
+          };
+          blocks.push(toolUse);
+          toolUseById.set(id, toolUse);
+          toolUseStartMs.set(id, synthDate.getTime());
+        }
         if (blocks.length === 0) {
           entries.push({
             type: "system",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.4-beta.4",
+  "version": "1.0.4-beta.6",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -121,15 +121,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.4",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.4",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.4",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.4"
+    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.6",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.6"
   },
   "failproofaidBinaries": {
-    "linux-x64": "4487790ed9b881da2914b5985a23b5adca1f20e226d71c635d8170064e6b2340",
-    "linux-arm64": "c903c5e201198213ccd8295fdab741c7d08d22c8dd5c276e52aa766595bedcc2",
-    "darwin-x64": "f0933584abbf0f9ff95cd153f8c6c704e467af1d6ffc8f42f9c426bd44b1142a",
-    "darwin-arm64": "387a3acbf13f667a557c8ac632fe67dee350cda078e3266e71edfcfacb9ecae6"
+    "linux-x64": "24118b8bd058cc5d8711053c4c77cdca9361c12dbf0f421a757d33f07596d428",
+    "linux-arm64": "b4278c34a288de2c747bcebcc623d8fd5bda3a1f1e55800926eb1a4b89f0a5e9",
+    "darwin-x64": "ecb66699f45f605b0d54ac9e4bac360ac11e4e136442dcccdd083514d77c7d42",
+    "darwin-arm64": "b3dbad58bda960ef9481f90bc5085ba8624b2472519cc0bf212a0e8451dd2db4"
   }
 }

package/pi-extension/index.ts

@@ -49,7 +49,6 @@ function resolveSpawn(): { cmd: string; args: string[] } {
 interface PolicyDecision {
   permission?: "allow" | "deny";
   reason?: string;
-  failproofaiNotice?: string;
 }
 
 /**
@@ -83,7 +82,10 @@ function debug(msg: string): void {
  * NOT used for `tool_call`, `user_bash`, `input` or `agent_end`: those four
  * consume the decision, and blocking is what enforcement means.
  */
-function forwardPolicy(eventName: string, payload: unknown): void {
+function forwardPolicy(
+  eventName: string,
+  payload: unknown,
+): void {
   const { cmd, args } = resolveSpawn();
   debug(`forwardPolicy (detached) event=${eventName} cmd=${cmd}`);
   try {
@@ -96,14 +98,14 @@ function forwardPolicy(eventName: string, payload: unknown): void {
     child.unref();
     // EPIPE if the child died before stdin was consumed — fail-open, silently.
     child.on("error", (err) => debug(`forward error ${err.message}`));
-    child.stdin.on("error", () => {});
-    child.stdin.end(JSON.stringify(payload));
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(JSON.stringify(payload));
   } catch (err) {
     debug(`FORWARD EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 
-function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string; notice?: string } {
+function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string } {
   const { cmd, args } = resolveSpawn();
   debug(`callPolicy event=${eventName} cmd=${cmd}`);
   try {
@@ -125,10 +127,9 @@ function callPolicy(eventName: string, payload: unknown): { block: boolean; reas
       return {
         block: true,
         reason: parsed.reason ?? "Blocked by failproofai",
-        notice: parsed.failproofaiNotice,
       };
     }
-    return { block: false, reason: "", notice: parsed.failproofaiNotice };
+    return { block: false, reason: "" };
   } catch (err) {
     debug(`EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
     // Fail-open: never block tool execution because of an infra failure.
@@ -376,13 +377,7 @@ interface PiBeforeAgentStartEvent {
 }
 
 interface PiExtensionApi {
-  on(event: string, handler: (event: unknown, ctx?: PiExtensionContext) => unknown): void;
-}
-
-interface PiExtensionContext {
-  ui?: {
-    notify(message: string, type?: "info" | "warning" | "error"): void;
-  };
+  on(event: string, handler: (event: unknown) => unknown): void;
 }
 
 export default function failproofaiBridge(pi: PiExtensionApi) {
@@ -503,7 +498,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   // The 5 require-*-before-stop builtins thus enforce by gating the NEXT
   // user turn's system prompt rather than by retrying the same loop. If the
   // user kills Pi between turns, the gate is missed — same bound Claude has.
-  pi.on("agent_end", (event: unknown, ctx?: PiExtensionContext): unknown => {
+  pi.on("agent_end", (event: unknown): unknown => {
     const e = event as PiAgentEndEvent;
     const cwd = resolveCwd(e.cwd);
     const sessionId = resolveSessionId(e.sessionId, cwd);
@@ -516,9 +511,6 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       pendingStopBlockBySession.set(sessionId, decision.reason);
       debug(`agent_end deny stored for session=${sessionId}`);
     }
-    if (decision.notice) {
-      try { ctx?.ui?.notify(decision.notice, "warning"); } catch { /* fail-open */ }
-    }
     return undefined;
   });
 

package/src/audit/cli.ts

@@ -3,7 +3,7 @@
  * the dashboard to view it.
  *
  *   failproofai audit                Scan, then launch the dashboard at /audit.
- *   failproofai audit --schedule     Put scans on a timer and mail the findings.
+ *   failproofai audit --schedule     Put local scans and notifications on a timer.
  *   failproofai audit --no-schedule  Stop the timer.
  *   failproofai audit --status       What this machine is scheduled to do.
  *   failproofai audit -h, --help     Show usage.
@@ -37,10 +37,9 @@ import { openWhenReady } from "./open-browser";
 import { describeOutcome, reportHarm } from "./report-harm";
 import { notifyDesktop } from "./desktop-notify";
 import { macNotifierInstalled, pruneMacNotifyQueue, queueMacNotification } from "./macos-notifier";
-import { markLeakNoticeDelivered, releaseLeakNoticeClaims } from "./leak-notice";
-import { desktopLeakNotice } from "../hooks/notice";
-import { activeFindings, readLeakRecord } from "./leak-store";
+import { desktopLeakNotice, type DesktopLeakEmailState } from "../hooks/notice";
 import { readConfig } from "../hooks/fp-config";
+import { readAuth } from "../../lib/auth/auth-store";
 import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM, helpScreen, helpOptsFor } from "../hooks/tui";
 import { version } from "../../package.json";
 
@@ -104,29 +103,29 @@ export function helpText(): string {
           label: "usage",
           entries: [
             ["(bare)", `Scan your session history for leaked keys, then open http://localhost:${DASHBOARD_PORT}/audit`],
-            ["--schedule [days]", "Scan on a timer, notify you on this machine, and email the findings. Default 7 days, range 1-90. Signs you in the first time."],
+            ["--schedule [days]", "Scan on a timer and notify you on this machine. Default 7 days, range 1-90. No account required."],
             // Its own row now, rather than a clause inside --schedule's. It
             // does not stand alone, which is why it used to be a clause — but
             // a clause wraps, and `--email <address>` landing with the flag at
             // the end of one line and its placeholder at the start of the next
             // is not a flag anybody can read or copy.
-            ["--email <address>", "With --schedule, fills in your address. A sign-in code is still emailed to you to paste."],
+            ["--email <address>", "With --schedule, add email alerts for the most recent masked credential leak. A sign-in code is emailed to you."],
             ["--no-schedule", "Stop the timer. Leaves you signed in."],
             // Its own pair of flags rather than a clause on --schedule: whether
             // this machine scans and whether it may interrupt you are separate
             // decisions, and nobody silencing a banner should have to re-state
             // their schedule to do it.
             ["--notify", "Show a desktop notification when a scan finds a credential. On by default."],
-            ["--no-notify", "Stop those notifications. Scans and the digest are unaffected."],
+            ["--no-notify", "Stop desktop notifications. Scheduled scans and optional email alerts are unaffected."],
             ["--status", "Whether scheduling is on, where reports go, the daemon's state, and when the next scan is due."],
             ["-h, --help", "Show this help."],
           ],
         },
       ],
       footer: [
-        "Everything runs on this machine. A scan tells you three ways: a desktop",
-        "notification, two lines in your agent session, and the emailed digest —",
-        "and only that digest ever leaves.",
+        "Every scan runs on this machine. Leak alerts appear as desktop system",
+        "notifications, never inside agent sessions. If you add email, only the",
+        "newest masked credential exposure and its metadata leave the machine.",
       ],
     },
     helpOptsFor(process.stdout),
@@ -378,9 +377,12 @@ function heldByLine(held: AuditLockInfo | null): string {
  * turning a good scan into exit 1 would make the scheduler back off from
  * running the thing that actually matters.
  */
-async function announceLeaksOnDesktop(result: AuditResult): Promise<void> {
+async function announceLeaksOnDesktop(
+  result: AuditResult,
+  report: Awaited<ReturnType<typeof reportHarm>>,
+): Promise<void> {
   try {
-    await announceLeaksOrThrow(result);
+    await announceLeaksOrThrow(result, report);
   } catch (err) {
     // The catch is not decoration. `notifyDesktop` documents that it never
     // throws, but it is doing socket I/O, and so are the config read and the
@@ -394,29 +396,22 @@ async function announceLeaksOnDesktop(result: AuditResult): Promise<void> {
   }
 }
 
-async function announceLeaksOrThrow(result: AuditResult): Promise<void> {
-  const ids = result.newLeakIds ?? [];
+async function announceLeaksOrThrow(
+  result: AuditResult,
+  report: Awaited<ReturnType<typeof reportHarm>>,
+): Promise<void> {
+  // `leakIds` includes credentials this scan encountered before. A scheduled
+  // run is a fresh safety check, so it must raise a fresh system notification
+  // when the leak is still present; the old per-finding marker is why only the
+  // first test run ever produced a banner. Older cached results fall back to
+  // first-seen ids.
+  const ids = result.leakIds ?? result.newLeakIds ?? [];
   if (ids.length === 0) return;
   // Read at fire time, not at scan time: the switch answers "should this
   // interrupt me", and it is the user's most recent answer that counts.
   if (!readConfig().audit.notify) return;
 
-  // Claimed BEFORE the call goes out, and in the desktop channel only. Before,
-  // because a process that dies mid-notify would otherwise re-announce the same
-  // finding on every scheduled run forever; desktop-only, because a banner the
-  // user may never have seen must not also silence the in-session notice.
-  const claimed = markLeakNoticeDelivered(ids, undefined, "desktop");
-  if (claimed.length === 0) return;
-
-  // Report what SURVIVED into the record, not how many ids the scan minted.
-  // `writeLeakRecord` prunes to MAX_FINDINGS, so on a large history the two
-  // numbers diverge wildly — a real run announced "5703 credentials" while the
-  // dashboard it points at showed 500. A banner that disagrees with the page it
-  // sends you to is worse than no banner: it teaches you the number is noise.
-  const live = new Set(activeFindings(readLeakRecord()).map((f) => f.id));
-  const shown = claimed.filter((id) => live.has(id)).length || claimed.length;
-
-  const n = shown === 1 ? "a possible credential exposure" : `${shown} possible credential exposures`;
+  const n = ids.length === 1 ? "a possible credential exposure" : `${ids.length} possible credential exposures`;
   // Fixed text with no scanned content and no count. A finding's own text comes
   // from a repository this machine cloned, and notification bodies render
   // markup on several Linux desktops. The count is intentionally left to the
@@ -427,54 +422,52 @@ async function announceLeaksOrThrow(result: AuditResult): Promise<void> {
   // delivers the click back as an `ActionInvoked` signal to the sender — and
   // this process exits as soon as the scan finishes, so the button would be
   // dead. A plain command the user can copy beats a button that does nothing.
-  const { title, body } = desktopLeakNotice();
-  let delivered = false;
-
-  try {
-    // The two platforms need opposite things, and the split is not cosmetic. On
-    // Linux this process can reach the session bus itself. On macOS it cannot
-    // reach Notification Center at all — it is a child of a LaunchDaemon, outside
-    // the GUI session — so it hands the message to an agent that lives inside
-    // one. See `macos-notifier.ts` for why that agent exists.
-    if (process.platform === "darwin") {
-      pruneMacNotifyQueue();
-      if (!queueMacNotification(claimed[0], title, body)) {
-        process.stderr.write(`failproofai: found ${n} but could not queue a notification\n`);
-      } else {
-        delivered = true; // the durable queue owns delivery from here
-      }
-      if (delivered && !macNotifierInstalled()) {
-        // Queued, but nothing currently collects it. Keep the claim because the
-        // payload is durable and will be consumed when the LaunchAgent returns.
-        // Worth a line, because the immediate symptom is otherwise silence.
-        process.stderr.write(
-          `failproofai: found ${n}; the notifier is not installed, so nothing will show it ` +
-            `(run \`failproofai config\`)\n`,
-        );
-      }
-      return;
-    }
-
-    const outcome = await notifyDesktop(
-      title,
-      body,
-      // A stable id would let a repeat scan replace the previous bubble instead
-      // of stacking. We do not have one yet — the server assigns it and we would
-      // have to persist it — so a fresh notification is correct here, and it is
-      // bounded: at most one per distinct credential, ever.
-      0,
-    );
-    delivered = outcome.ok;
-    if (!outcome.ok) {
-      // stderr, so it lands in the journal beside the run it belongs to. Not a
-      // failure of the audit — but "we found a key and could not tell you" is
-      // exactly the sentence someone debugging this needs to find.
+  const emailState: DesktopLeakEmailState =
+    report.kind === "sent"
+      ? "sent"
+      : report.kind === "signed-out" || !readAuth()
+        ? "missing"
+        : report.kind === "failed"
+          ? "failed"
+          : "held";
+  const { title, body } = desktopLeakNotice(emailState);
+
+  // The two platforms need opposite things, and the split is not cosmetic. On
+  // Linux this process can reach the session bus itself. On macOS it cannot
+  // reach Notification Center at all — it is a child of a LaunchDaemon, outside
+  // the GUI session — so it hands the message to an agent that lives inside
+  // one. See `macos-notifier.ts` for why that agent exists.
+  if (process.platform === "darwin") {
+    pruneMacNotifyQueue();
+    if (!queueMacNotification(ids[0], title, body)) {
+      process.stderr.write(`failproofai: found ${n} but could not queue a notification\n`);
+    } else if (!macNotifierInstalled()) {
+      // Queued, but nothing currently collects it. The payload is durable and
+      // will be consumed when the LaunchAgent returns.
+      // Worth a line, because the immediate symptom is otherwise silence.
       process.stderr.write(
-        `failproofai: found ${n} but could not raise a desktop notification (${outcome.reason})\n`,
+        `failproofai: found ${n}; the notifier is not installed, so nothing will show it ` +
+          `(run \`failproofai config\`)\n`,
       );
     }
-  } finally {
-    if (!delivered) releaseLeakNoticeClaims(claimed, undefined, "desktop");
+    return;
+  }
+
+  const outcome = await notifyDesktop(
+    title,
+    body,
+    // `0` asks the notification server for a fresh id. Each scheduled scan that
+    // still sees a leak is a new reminder, rather than replacing or suppressing
+    // the first banner forever.
+    0,
+  );
+  if (!outcome.ok) {
+    // stderr, so it lands in the journal beside the run it belongs to. Not a
+    // failure of the audit — but "we found a key and could not tell you" is
+    // exactly the sentence someone debugging this needs to find.
+    process.stderr.write(
+      `failproofai: found ${n} but could not raise a desktop notification (${outcome.reason})\n`,
+    );
   }
 }
 
@@ -548,12 +541,9 @@ export async function runScheduledAudit(): Promise<number> {
         `${num(result.transcripts.scanned)} sessions, ${num(result.totals.hits)} hits\n`,
     );
 
-    // Tell whoever owns this machine, on the machine, before anything is sent
-    // anywhere. Local first: this is the channel that works with no account, no
-    // email and no network, which describes most users.
-    await announceLeaksOnDesktop(result);
-
-    // Report harmful findings upstream, if the user switched emailed reports on.
+    // Email is optional and never controls the local scan. Run it first only so
+    // the desktop notification can truthfully say whether this particular
+    // alert was also emailed; every failure remains a non-fatal outcome.
     //
     // AFTER the dashboard cache is written and AFTER the success line, because
     // the scan is the product and this is an optional extra on top of it.
@@ -567,6 +557,7 @@ export async function runScheduledAudit(): Promise<number> {
     // would also make the manual command do a network call that
     // `audit --help` promises it does not.
     const outcome = await reportHarm(result);
+    await announceLeaksOnDesktop(result, outcome);
     const line = describeOutcome(outcome);
     if (line) {
       // Anything other than a successful send goes to stderr: on a scheduled run

package/src/audit/harm-report.ts

@@ -1,10 +1,11 @@
 /**
  * Turning an audit result into a harm report the api-server can act on.
  *
- * Runs only after a SCHEDULED scan (`failproofai audit --scheduled`), only when
- * the user has switched emailed reports on, and only ever from the audit child —
- * never the daemon, which holds no human credential precisely so that refresh
- * rotation stays inside the audit lock. See `crates/failproofaid/src/audit_lane.rs`.
+ * Runs only after a SCHEDULED scan (`failproofai audit --scheduled`) and only
+ * ever from the audit child — never the daemon, which holds no human credential
+ * precisely so that refresh rotation stays inside the audit lock. Without an
+ * email identity the scan and desktop notification still work; this module
+ * simply reports `signed-out` and sends nothing.
  *
  * ## What counts as harm
  *
@@ -302,7 +303,10 @@ export function selectLeaks(findings: LeakFinding[], from: Date, to: Date): Repo
     // is now, not where it was first noticed.
     // Defensive even though `readLeakRecord` already sanitises: this is
     // exported and takes whatever a caller hands it.
-    const seen = f.sightings?.[f.sightings.length - 1];
+    const seen = f.sightings?.reduce((latest, candidate) => {
+      if (!latest) return candidate;
+      return (ts(candidate.at) ?? 0) >= (ts(latest.at) ?? 0) ? candidate : latest;
+    }, undefined as LeakFinding["sightings"][number] | undefined);
     out.push({
       id: f.id,
       display: f.fingerprint?.display ?? "[credential]",
@@ -356,6 +360,8 @@ export function buildHarmReport(
     window_from: from.toISOString(),
     window_to: windowTo.toISOString(),
     harmful: selectHarmful(result, from, windowTo, { includeUnplaceable: isFirstReport }),
-    leaks: selectLeaks(leakFindings, from, windowTo),
+    // One email, one actionable credential. Sending every row turns a leak
+    // alert into a backlog digest and obscures the event that just happened.
+    leaks: selectLeaks(leakFindings, from, windowTo).slice(0, 1),
   };
 }