failproofai 1.0.4-beta.4 → 1.0.4-beta.7

package/src/audit/index.ts

@@ -70,7 +70,7 @@ const TRANSCRIPT_BYTE_BUDGET = 48 * 1024 * 1024;
  * otherwise the largest transcript on the machine could never be scanned, which
  * is precisely the one most likely to hold something.
  */
-class ByteGate {
+export class ByteGate {
   private inFlight = 0;
   private waiting: Array<() => void> = [];
 
@@ -794,9 +794,11 @@ async function runAuditInner(opts: RunAuditOptions, startedAt: number): Promise<
     errors === 0 &&
     skipped === 0;
   const newFindingIds = persistLeaks(perTranscript, coversAllHistory);
+  const leakIds = [...new Set(perTranscript.flatMap((t) => (t.leaks ?? []).map((leak) => leak.id)))];
 
   const auditResult: AuditResult = {
     version: 2,
+    leakIds,
     newLeakIds: newFindingIds,
     scannedAt: new Date(startedAt).toISOString(),
     scope: {

package/src/audit/leak-fingerprint.ts

@@ -178,10 +178,8 @@ export function fingerprintSecret(value: string, fallbackLabel = "secret"): Leak
 /**
  * Every id `fingerprintId` can produce, and nothing else.
  *
- * Ids become FILENAMES — one marker file per notified finding, one queue file
- * per pending macOS banner — so an id is a path component, and a path component
- * built from unvalidated input is a directory traversal. Measured: passing
- * `"../../../../tmp/PWNED"` to `markLeakNoticeDelivered` created that file.
+ * Ids become FILENAMES for pending macOS banners, so an id is a path component,
+ * and a path component built from unvalidated input is a directory traversal.
  *
  * Ids are HMAC hex today, so nothing in a normal run can carry a `/`. That is
  * not the same as safe: the record is JSON read off disk, and `leaks.json` is a

package/src/audit/leak-record.ts

@@ -152,19 +152,30 @@ export function upsertFinding(
     return { record, isNew: true };
   }
 
+  // Keep the earliest sighting AND the most recent evidence. The report/email
+  // promises the CLI and timestamp of the latest exposure; keeping only the
+  // first five made those fields stale forever after a busy credential crossed
+  // the cap. Middle sightings are the expendable ones.
+  const seen = existing.sightings.some(
+    (s) =>
+      s.sessionId === sighting.sessionId &&
+      s.at === sighting.at &&
+      s.mechanism.direction === sighting.mechanism.direction &&
+      s.mechanism.summary === sighting.mechanism.summary,
+  );
+  // Cached transcript results are folded through this function again. An
+  // identical sighting is therefore not a new exposure and must not inflate
+  // the count each time the same cache entry is reused.
+  if (seen) return { record, isNew: false };
+
   existing.occurrences += 1;
   if (sighting.at > existing.lastSeen) existing.lastSeen = sighting.at;
   if (sighting.at < existing.firstSeen) existing.firstSeen = sighting.at;
 
-  // Keep the FIRST sightings rather than the most recent. The first exposure is
-  // the one that explains how the credential got into the transcript at all;
-  // later ones are usually the same value being replayed, and a checkpoint
-  // record replaying a prompt is not new information.
-  if (existing.sightings.length < MAX_SIGHTINGS) {
-    const seen = existing.sightings.some(
-      (s) => s.sessionId === sighting.sessionId && s.at === sighting.at,
-    );
-    if (!seen) existing.sightings.push(sighting);
+  existing.sightings.push(sighting);
+  existing.sightings.sort((a, b) => a.at.localeCompare(b.at));
+  if (existing.sightings.length > MAX_SIGHTINGS) {
+    existing.sightings.splice(1, existing.sightings.length - MAX_SIGHTINGS);
   }
   return { record, isNew: false };
 }
@@ -177,7 +188,12 @@ export function upsertFinding(
  */
 export function pruneRecord(record: LeakRecord, nowMs: number): LeakRecord {
   const cutoff = new Date(nowMs - FINDING_TTL_DAYS * 86_400_000).toISOString();
-  const live = record.findings.filter((f) => f.lastSeen >= cutoff);
+  // A missing or malformed timestamp cannot be aged out safely. Keep it until
+  // the bounded-cap pass below rather than silently deleting a finding that the
+  // reporting path deliberately surfaces as having an unknown date.
+  const live = record.findings.filter(
+    (f) => !f.lastSeen || !Number.isFinite(Date.parse(f.lastSeen)) || f.lastSeen >= cutoff,
+  );
   live.sort((a, b) => (a.lastSeen < b.lastSeen ? 1 : a.lastSeen > b.lastSeen ? -1 : 0));
   record.findings = live.slice(0, MAX_FINDINGS);
   return record;

package/src/audit/leak-scan.ts

@@ -33,7 +33,7 @@ import { SECRET_PATTERNS } from "../hooks/builtin-policies";
  * `result.leaks` forever, which made a precision fix appear to do nothing on a
  * warm machine. Bump this whenever matching or suppression semantics change.
  */
-export const LEAK_SCAN_VERSION = 5;
+export const LEAK_SCAN_VERSION = 6;
 
 /** One credential value found in one event. */
 export interface SecretMatch {

package/src/audit/leak-store.ts

@@ -46,24 +46,6 @@ interface LeakIdentity {
   salt: string;
   /** Finding ids the user has said are not secrets. */
   dismissed: string[];
-  /**
-   * When the user last actually LOOKED at the leak report, as epoch ms.
-   *
-   * This is what stops the in-CLI notice, and it replaces a per-finding "we
-   * emitted it once" marker that silently lost the alert twice in one day: once
-   * because it was claimed on an event whose channel the host ignores, and once
-   * because hooks were disabled in the project being tested. Both marked every
-   * finding delivered and showed nothing, with no retry, ever.
-   *
-   * Keyed on the user's own action rather than on ours, the failure direction
-   * inverts: a dropped notice simply reappears next session, and the only thing
-   * that silences it is the user opening the report — which is the outcome the
-   * notice exists to produce.
-   *
-   * `identity`, alongside `dismissed`, for the same reason: losing it re-alerts
-   * about credentials somebody has already seen and judged.
-   */
-  reportViewedAt?: number;
 }
 
 /** Mode for both files. They carry no credential, but they do carry a machine
@@ -95,10 +77,6 @@ export function readLeakIdentity(home?: string): LeakIdentity {
     return {
       salt: existing.salt,
       dismissed: existing.dismissed ?? [],
-      reportViewedAt:
-        typeof existing.reportViewedAt === "number" && Number.isFinite(existing.reportViewedAt)
-          ? existing.reportViewedAt
-          : undefined,
     };
   }
   const minted: LeakIdentity = { salt: randomBytes(32).toString("hex"), dismissed: [] };
@@ -146,7 +124,7 @@ export function writeLeakIdentity(identity: LeakIdentity, home?: string): boolea
 function sanitizeFinding(raw: unknown): LeakFinding | null {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const f = raw as Record<string, unknown>;
-  // The id becomes a FILENAME (notice markers, the macOS queue), so anything
+  // The id becomes a filename in the macOS notification queue, so anything
   // that is not the exact minted shape disqualifies the whole entry.
   if (typeof f.id !== "string" || !isFindingId(f.id)) return null;
 
@@ -219,29 +197,6 @@ export function writeLeakRecord(record: LeakRecord, home?: string, nowMs = Date.
 }
 
 /** Mark a finding as not-a-secret. Survives a reset; see the module header. */
-/**
- * Record that the user has seen the leak report.
- *
- * Called from the dashboard when it reads the findings, and from the
- * interactive `failproofai audit`, which prints them. Both are the user
- * looking — which is the only signal worth silencing the notice on.
- *
- * Never throws: failing to record a view costs one extra notice, which is the
- * side this whole design errs on.
- */
-export function markLeakReportViewed(home?: string, nowMs = Date.now()): void {
-  try {
-    const identity = readLeakIdentity(home);
-    writeJsonAtomically(
-      auditLeakIdentityFile(home),
-      { ...identity, reportViewedAt: nowMs },
-      { mode: FILE_MODE },
-    );
-  } catch {
-    // See the doc comment: an unrecorded view re-notifies once.
-  }
-}
-
 export function dismissFinding(id: string, home?: string): boolean {
   const identity = readLeakIdentity(home);
   if (identity.dismissed.includes(id)) return true;

package/src/audit/machine-store.ts

@@ -7,9 +7,8 @@
  *  - `machine_id` is what the api-server keys reports on. Regenerate it and the
  *    server sees a brand-new machine, which burns a slot off the account's cap
  *    on every logout and splits one box's history into two.
- *  - `last_reported_at` is how far the last digest reached. Reset it and the
- *    next report re-covers months of history, and the user gets a digest of
- *    everything that ever happened as though it just did.
+ *  - `last_reported_at` is how far the last credential alert reached. Reset it
+ *    and the next report can re-cover old exposures as though they just happened.
  *
  * That is why this is a separate file from `session.json` rather than two more
  * keys in it: signing out deletes the session, and neither of these may go with
@@ -22,7 +21,7 @@
  * `state/telemetry-id` is already a stable per-machine random id and would have
  * been free to reuse. It is deliberately not reused: that id is the anonymous
  * PostHog person, and sending it alongside a verified email address would link
- * the two the moment somebody turns emailed reports on. Opting into a digest
+ * the two the moment somebody adds email alerts. Opting into email
  * should not de-anonymise telemetry, so this feature gets its own id and the
  * two never meet.
  */
@@ -66,8 +65,8 @@ export function readMachineIdentity(home?: string): MachineIdentity | null {
 /**
  * Read the identity, creating it on first call.
  *
- * Only ever called from the reporting path, so a machine that never opts into
- * emailed reports never gets an id at all — there is nothing to mint one for.
+ * Only ever called from the email-reporting path, so a machine without a valid
+ * email identity never gets an id at all — there is nothing to mint one for.
  */
 export function ensureMachineIdentity(home?: string): MachineIdentity {
   const existing = readMachineIdentity(home);
@@ -81,13 +80,13 @@ export function ensureMachineIdentity(home?: string): MachineIdentity {
 }
 
 /**
- * Record how far the last DELIVERED digest reached.
+ * Record how far the last delivered credential alert reached.
  *
  * The value is the server's `next_window_from`, not the window this run
  * scanned. The server is authoritative because it knows which reports actually
  * produced an email — a report held by the cooldown, or one whose send failed,
  * must not advance the watermark or its findings are silently dropped from every
- * future digest.
+ * future alert.
  */
 export function recordReportWatermark(nextWindowFrom: string, home?: string): void {
   const current = ensureMachineIdentity(home);
@@ -105,7 +104,7 @@ export function deleteMachineIdentity(home?: string): void {
 /**
  * A display name for this machine — its hostname.
  *
- * Shown in the digest so somebody with three boxes can tell which one is
+ * Shown in the email alert so somebody with three boxes can tell which one is
  * misbehaving, which is the whole reason it is sent. Falls back to `undefined`
  * rather than a placeholder: the server keeps whatever label it already has when
  * one is omitted, so guessing here would overwrite a good name with a bad one.

package/src/audit/macos-notifier.ts

@@ -24,13 +24,13 @@
  * would install for every account on the box, which is not what a per-user
  * notification is.
  *
- * **An app bundle, not a bare `osascript -e 'display notification'`.** A raw
- * osascript notification is attributed to whatever host ran it — in practice
- * "Script Editor" — so it inherits Script Editor's notification permission,
- * appears under Script Editor in System Settings, and is indistinguishable from
- * any other script on the machine. Compiling a tiny applet with `osacompile`
- * gives it its own bundle identifier, so the banner says failproofai, and the
- * user gets a real entry they can allow, silence or deny like any other app.
+ * **A user-session `osascript`, not an applet binary launched directly.** The
+ * compiled applet path looked attractive because it could carry a FailproofAI
+ * bundle identifier, but launching `Contents/MacOS/applet` directly from
+ * launchd is not a dependable Notification Center client on current macOS.
+ * `osascript` from a user LaunchAgent is the same mechanism ordinary scheduled
+ * jobs use successfully. Delivery matters more than owning the label shown by
+ * Notification Center, so the runner uses that proven path.
  *
  * **A watched drop directory, not a resident process.** The agent is not a
  * daemon: `WatchPaths` makes launchd start it only when a file appears, and it
@@ -45,25 +45,29 @@
  * the thing that lasts.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
 
 import { runDir } from "../hooks/fp-home";
 import { isFindingId } from "./leak-fingerprint";
 
-/** The bundle identifier the banner is attributed to, and the agent's label. */
+/** Stable label used to load, inspect, and remove the per-user LaunchAgent. */
 export const MAC_NOTIFIER_LABEL = "ai.failproof.notifier";
 
 /** Where a queued notification waits for the agent to pick it up. */
 export const macNotifyDir = (home?: string) => resolve(runDir(home), "notify");
 
-/** The compiled applet. Under `~/.failproofai` rather than `/Applications`,
- *  because it is a delivery mechanism, not something to launch. */
+/** Legacy compiled applet path, retained so upgrades and uninstall remove it. */
 export function macNotifierAppPath(home?: string): string {
   return resolve(runDir(home), "..", "bin", "FailproofAI Notifier.app");
 }
 
+/** User-session runner invoked by launchd when a notification is queued. */
+export function macNotifierRunnerPath(home?: string): string {
+  return resolve(runDir(home), "..", "bin", "failproofai-notifier.zsh");
+}
+
 export function macNotifierPlistPath(): string {
   return resolve(homedir(), "Library", "LaunchAgents", `${MAC_NOTIFIER_LABEL}.plist`);
 }
@@ -73,11 +77,11 @@ function escapeXml(s: string): string {
 }
 
 /**
- * The AppleScript the applet runs: drain the directory, say each line, exit.
+ * The user-session runner: drain the directory, say each notification, exit.
  *
- * Payload format is two lines — title, then body — chosen over JSON because
- * AppleScript has no JSON parser and shelling out to one would put a second
- * interpreter in the path of a two-field message.
+ * Payload format is two lines — title, then body. Values are passed to
+ * AppleScript as argv, never interpolated into source, so notification text
+ * cannot become AppleScript code.
  *
  * The file is REMOVED BEFORE the notification is posted, and that order is
  * deliberate: `WatchPaths` fires on every change to the directory, so a file
@@ -88,32 +92,25 @@ function escapeXml(s: string): string {
  */
 export function notifierScript(home?: string): string {
   const dir = macNotifyDir(home);
-  return `on run
-	set dropDir to ${JSON.stringify(dir + "/")}
-	set listing to ""
-	try
-		set listing to do shell script "ls -1 " & quoted form of dropDir & " 2>/dev/null"
-	end try
-	repeat with entryName in paragraphs of listing
-		set entryPath to dropDir & (entryName as string)
-		if (entryName as string) is not "" then
-			try
-				set payload to do shell script "cat " & quoted form of entryPath & " 2>/dev/null"
-				do shell script "rm -f " & quoted form of entryPath
-				set lines_ to paragraphs of payload
-				if (count of lines_) is greater than 1 then
-					set noteTitle to item 1 of lines_
-					set noteBody to ""
-					repeat with i from 2 to (count of lines_)
-						if noteBody is not "" then set noteBody to noteBody & " "
-						set noteBody to noteBody & (item i of lines_)
-					end repeat
-					display notification noteBody with title noteTitle
-				end if
-			end try
-		end if
-	end repeat
+  const quotedDir = `'${dir.replace(/'/g, `'\\''`)}'`;
+  return `#!/bin/zsh
+set -u
+setopt NULL_GLOB
+
+drop_dir=${quotedDir}
+
+for entry_path in "$drop_dir"/*; do
+  [ -f "$entry_path" ] || continue
+  note_title=$(/usr/bin/sed -n '1p' "$entry_path")
+  note_body=$(/usr/bin/sed -n '2,$p' "$entry_path" | /usr/bin/tr '\\n' ' ')
+  /bin/rm -f "$entry_path"
+  [ -n "$note_title" ] || continue
+  /usr/bin/osascript - "$note_title" "$note_body" <<'APPLESCRIPT'
+on run argv
+  display notification (item 2 of argv) with title (item 1 of argv)
 end run
+APPLESCRIPT
+done
 `;
 }
 
@@ -122,7 +119,7 @@ end run
  * assert this file's shape from a Linux CI runner, which is every CI runner we
  * have.
  */
-export function notifierPlistContents(appPath: string, watchDir: string): string {
+export function notifierPlistContents(runnerPath: string, watchDir: string): string {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -131,7 +128,7 @@ export function notifierPlistContents(appPath: string, watchDir: string): string
     <string>${escapeXml(MAC_NOTIFIER_LABEL)}</string>
     <key>ProgramArguments</key>
     <array>
-        <string>${escapeXml(resolve(appPath, "Contents", "MacOS", "applet"))}</string>
+        <string>${escapeXml(runnerPath)}</string>
     </array>
     <!-- Started only when something is queued, and it exits when the queue is
          empty. RunAtLoad would fire it once at login with nothing to say. -->
@@ -173,36 +170,26 @@ function run(cmd: string, args: string[]): void {
  * machine scan, and may it interrupt), and both of those are real settings.
  *
  * Returns rather than throws. Notifications are one channel of several, and a
- * Mac that cannot compile an applet must still finish setting up its daemon,
- * its hooks and its policies — the parts that actually enforce anything.
+ * Mac that cannot load the user LaunchAgent must still finish setting up its
+ * daemon, hooks and policies — the parts that actually enforce anything.
  */
 export function installMacNotifier(home?: string): MacNotifierResult {
   if (process.platform !== "darwin") return { installed: false, reason: "not macOS" };
   try {
-    const app = macNotifierAppPath(home);
+    const runner = macNotifierRunnerPath(home);
     const watch = macNotifyDir(home);
     mkdirSync(watch, { recursive: true, mode: 0o700 });
-    mkdirSync(resolve(app, ".."), { recursive: true });
-
-    const scriptPath = resolve(watch, "..", "notifier.applescript");
-    writeFileSync(scriptPath, notifierScript(home), { mode: 0o600 });
-    // osacompile refuses to overwrite an existing bundle, so a reinstall (a
-    // second `failproofai config`, or an upgrade) has to clear it first.
-    rmSync(app, { recursive: true, force: true });
-    run("osacompile", ["-o", app, scriptPath]);
-    rmSync(scriptPath, { force: true });
-
-    // Give the bundle its own identity, so the banner is attributed to
-    // failproofai instead of to whatever compiled it, and so the user gets one
-    // entry in System Settings > Notifications they can turn off themselves.
-    const plist = resolve(app, "Contents", "Info.plist");
-    run("defaults", ["write", plist, "CFBundleIdentifier", MAC_NOTIFIER_LABEL]);
-    run("defaults", ["write", plist, "CFBundleName", "failproofai"]);
-    // `defaults write` leaves the file 0600 and owned by us but in binary
-    // format; launchd and LaunchServices both read either, so no conversion.
+    mkdirSync(resolve(runner, ".."), { recursive: true });
+    writeFileSync(runner, notifierScript(home), { mode: 0o700 });
+    // writeFileSync preserves an existing file's mode. Repair it explicitly on
+    // upgrades from a partially-created or hand-edited runner.
+    chmodSync(runner, 0o700);
+    // Remove the applet used by older builds. The LaunchAgent below no longer
+    // references it, and leaving it behind makes diagnosis ambiguous.
+    rmSync(macNotifierAppPath(home), { recursive: true, force: true });
 
     mkdirSync(resolve(macNotifierPlistPath(), ".."), { recursive: true });
-    writeFileSync(macNotifierPlistPath(), notifierPlistContents(app, watch), { mode: 0o644 });
+    writeFileSync(macNotifierPlistPath(), notifierPlistContents(runner, watch), { mode: 0o644 });
 
     const target = `gui/${process.getuid?.() ?? 0}`;
     // bootout first: bootstrap fails outright on an already-loaded label, and
@@ -220,7 +207,7 @@ export function installMacNotifier(home?: string): MacNotifierResult {
 }
 
 /**
- * Remove the agent and the bundle.
+ * Remove the agent and its runner, including the applet used by older builds.
  *
  * Called from `failproofai uninstall --purge`. Unconditional and quiet: an
  * agent left behind after an uninstall is a plist launchd keeps trying to start
@@ -236,6 +223,7 @@ export function uninstallMacNotifier(home?: string): void {
   }
   rmSync(macNotifierPlistPath(), { force: true });
   rmSync(macNotifierAppPath(home), { recursive: true, force: true });
+  rmSync(macNotifierRunnerPath(home), { force: true });
   rmSync(macNotifyDir(home), { recursive: true, force: true });
 }
 
@@ -255,8 +243,8 @@ export function queueMacNotification(
   body: string,
   home?: string,
 ): boolean {
-  // The id becomes a filename in a watched directory. Same guard, same reason
-  // as `markLeakNoticeDelivered` — see `isFindingId`.
+  // The id becomes a filename in a watched directory, so validate the path
+  // component before resolving it — see `isFindingId`.
   if (!isFindingId(id)) return false;
   const dir = macNotifyDir(home);
   const tmp = resolve(dir, "..", `notify-${id}.tmp`);
@@ -281,7 +269,7 @@ export function queueMacNotification(
 
 /** True when an agent is installed and could pick a queued file up. */
 export function macNotifierInstalled(home?: string): boolean {
-  return existsSync(macNotifierPlistPath()) && existsSync(macNotifierAppPath(home));
+  return existsSync(macNotifierPlistPath()) && existsSync(macNotifierRunnerPath(home));
 }
 
 /**

package/src/audit/redact-example.ts

@@ -573,6 +573,7 @@ export function redactAuditResult(result: AuditResult, home = homedir()): AuditR
     // Salted, machine-local ids. They carry no path and cannot be reversed to
     // a credential, so they pass through — but the decision is recorded here
     // rather than inherited from a spread.
+    leakIds: result.leakIds,
     newLeakIds: result.newLeakIds,
 
     // Everything below carries a path or user content and is rewritten.
@@ -615,5 +616,6 @@ export const REDACTED_AUDIT_RESULT_KEYS: ReadonlyArray<keyof AuditResult> = [
   "projectsScanned",
   "eventsScanned",
   "enabledBuiltinNames",
+  "leakIds",
   "newLeakIds",
 ];

package/src/audit/report-harm.ts

@@ -1,6 +1,6 @@
 /**
- * The side effect a scheduled audit has that no other audit does: telling the
- * api-server what it found, so a harm digest can be mailed.
+ * The optional remote side effect of a scheduled audit: telling the api-server
+ * about the newest masked credential exposure so an email alert can be sent.
  *
  * Separated from `harm-report.ts` on purpose. That module is pure — result in,
  * payload out — and is where the windowing rules live and are tested. This one
@@ -15,7 +15,7 @@
  * token expired, whose network is down, or whose api-server is having a bad day
  * must keep auditing itself locally and keep showing results on its own
  * dashboard — the local feature does not depend on the remote one, and a person
- * who never enabled emailed reports must never be able to tell this code exists.
+ * who never added an email must never have the local scan depend on this code.
  *
  * ## Why the CHILD does this and not the daemon
  *
@@ -35,6 +35,7 @@ import { activeFindings, readLeakRecord } from "./leak-store";
 import {
   ensureMachineIdentity,
   machineLabel,
+  readMachineIdentity,
   recordReportWatermark,
 } from "./machine-store";
 import type { AuditResult } from "./types";
@@ -42,31 +43,26 @@ import type { AuditResult } from "./types";
 /** What happened, for the one line the scheduled run prints. */
 export type HarmReportOutcome =
   | { kind: "disabled" }
-  | { kind: "consent-required" }
+  | { kind: "no-leak" }
   | { kind: "signed-out" }
-  | { kind: "sent"; hits: number }
-  | { kind: "held"; hits: number; reason: string }
+  | { kind: "sent"; leaks: number }
+  | { kind: "held"; leaks: number; reason: string }
   | { kind: "failed"; error: string };
 
 /**
- * Report this scan's harmful findings, if the user asked for that.
+ * Report this scan's newest credential exposure when an email identity exists.
  *
  * Returns an outcome rather than a boolean so the caller can say something
- * truthful. "held" in particular is not a failure — a machine below the
- * threshold, or inside its cooldown, is working exactly as intended, and a line
- * that called that an error would train people to ignore the line.
+ * truthful. "held" in particular is not a failure — a machine inside its
+ * cooldown is working exactly as intended, and a line that called that an error
+ * would train people to ignore the line.
  */
 export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome> {
-  // ONE switch. `auto` means "scan on a timer AND tell me", because the reason
-  // to put a scan on a timer is to be told — a machine scanning quietly with
-  // nothing to report to is a feature that looks on and does nothing visible.
   let auto = false;
-  let consentedAt: number | undefined;
   let intervalDays = 7;
   try {
     const config = readConfig();
     auto = config.audit.auto;
-    consentedAt = config.audit.reportsConsentedAt;
     // Also the width of a FIRST report's window, so a new machine's opening
     // digest covers the same period every later one will.
     intervalDays = config.audit.intervalDays;
@@ -76,13 +72,18 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
   }
   if (!auto) return { kind: "disabled" };
 
-  // `auto` alone is not consent to SEND, on a machine that set it before this
-  // existed. Through 1.0.0 that key meant "scan locally on a timer" — no
-  // account, no network, and the toggle that wrote it said so. Sending is
-  // gated on the separate stamp every current opt-in path writes, so a
-  // machine upgrading into this release keeps scanning and mails nothing until
-  // a person opts in again and sees what that sends. See `audit.reportsConsentedAt`.
-  if (consentedAt === undefined) return { kind: "consent-required" };
+  // Decide whether there is anything emailable before touching auth or the
+  // network. Scheduled scans are local by default; an email identity is an
+  // optional delivery channel, and a scan with no credential leak must make no
+  // report request at all.
+  const prior = readMachineIdentity();
+  const report = buildHarmReport(
+    result,
+    prior?.last_reported_at,
+    intervalDays,
+    activeFindings(readLeakRecord()),
+  );
+  if (report.leaks.length === 0) return { kind: "no-leak" };
 
   const auth = await getValidAccessToken();
   if (!auth) {
@@ -102,18 +103,6 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     return { kind: "failed", error: err instanceof Error ? err.message : String(err) };
   }
 
-  // The leak record is read here rather than carried on the AuditResult: the
-  // digest wants every credential still live in this window, not only the ones
-  // this particular scan happened to re-encounter. A key that leaked last month
-  // and was not touched by today's transcripts is still a key to rotate.
-  const report = buildHarmReport(
-    result,
-    identity.last_reported_at,
-    intervalDays,
-    activeFindings(readLeakRecord()),
-  );
-  const hits = report.harmful.reduce((n, p) => n + p.hits, 0);
-
   try {
     const res = await submitAuditReport(auth.access_token, {
       machine_id: identity.machine_id,
@@ -139,8 +128,8 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     }
 
     return res.emailed
-      ? { kind: "sent", hits }
-      : { kind: "held", hits, reason: res.reason ?? "not_sent" };
+      ? { kind: "sent", leaks: report.leaks.length }
+      : { kind: "held", leaks: report.leaks.length, reason: res.reason ?? "not_sent" };
   } catch (err) {
     // A 401 here means the session died between `getValidAccessToken` and this
     // call — rare, and indistinguishable from any other failure as far as this
@@ -160,19 +149,15 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
 export function describeOutcome(outcome: HarmReportOutcome): string | null {
   switch (outcome.kind) {
     case "disabled":
-      return null; // Say nothing at all to the majority who never opted in.
-    case "consent-required":
-      return "failproofai: scheduled scans are on, but emailing what they find needs a fresh opt-in — run `failproofai audit --schedule` (or visit /settings) to turn digests on";
+    case "no-leak":
+      return null;
     case "signed-out":
-      // Names the two places that can actually fix it. It used to say "sign in
-      // from the audit page", which stopped being true when this release moved
-      // that dialog behind "invite a friend".
-      return "failproofai: emailed reports are on but this machine is signed out — run `failproofai audit --schedule` or visit /settings to resume them";
+      return "failproofai: a credential exposure was found, but no email is configured — run `failproofai audit --schedule --email you@example.com`";
     case "sent":
-      return `failproofai: emailed a harm digest (${outcome.hits} finding${outcome.hits === 1 ? "" : "s"})`;
+      return "failproofai: emailed the most recent credential exposure";
     case "held":
-      return `failproofai: ${outcome.hits} finding${outcome.hits === 1 ? "" : "s"} reported, no email (${outcome.reason})`;
+      return `failproofai: credential exposure reported, no email (${outcome.reason})`;
     case "failed":
-      return `failproofai: could not send the harm report: ${outcome.error}`;
+      return `failproofai: could not send the credential alert: ${outcome.error}`;
   }
 }