failproofai 1.0.4-beta.4 → 1.0.4-beta.7

package/src/audit/schedule-cli.ts

@@ -68,13 +68,9 @@ const dim = (s: string) => wrap(ANSI_DIM, s);
 const bold = (s: string) => wrap(ANSI_BOLD, s);
 
 /**
- * Turn scheduled audits on, signing in first if needed.
- *
- * Scheduling and mailing are ONE decision — the reason to put a scan on a timer
- * is to be told what it found — so this requires a session, exactly as the
- * dashboard's `setAutoAuditAction` does. A timer set with nobody to tell is a
- * switch that reads as on and produces nothing, discoverable only by noticing
- * that no digest ever arrives.
+ * Turn scheduled audits on. Email is optional: `--email` signs in, while a
+ * plain `--schedule` enables the local scan and desktop notification without
+ * prompting for an account.
  *
  * The interval is written and then RE-READ, so what is printed is what the
  * config actually kept — `readIntervalDays` owns the 1..90 clamp and a second
@@ -108,17 +104,13 @@ export async function runScheduleOn(
     if (bad) throw new ScheduleCliError(bad);
   }
 
-  const { user, prompted } = await ensureSignedIn(emailArg);
+  const signedIn = emailArg === undefined
+    ? { user: readAuth()?.user ?? null, prompted: false }
+    : await ensureSignedIn(emailArg);
 
   const next = updateConfig({
-    // Stamped in the SAME call that sets `auto`, never separately: this records
-    // that a person completed a sign-in and read the disclosure printed below,
-    // and it is what `reportHarm` gates sending on. A machine that inherited
-    // `auto` from a release where it meant "scan locally" has no stamp and
-    // sends nothing until it comes through here.
     audit: {
       auto: true,
-      reportsConsentedAt: Date.now(),
       ...(days !== undefined ? { intervalDays: days } : {}),
     },
   });
@@ -134,12 +126,14 @@ export async function runScheduleOn(
   // The list is the real payload from `report-harm.ts`: machine id, hostname,
   // platform, the window bounds and the redacted examples.
   const summary = [
-    `every ${interval} day${interval === 1 ? "" : "s"} · reports to ${user.email}`,
-    "you only hear from it when a scan finds something harmful",
-    "each report sends: finding counts, redacted example commands, this machine's name",
+    `every ${interval} day${interval === 1 ? "" : "s"} · desktop notification on leaks`,
+    signedIn.user
+      ? `masked leak alerts also go to ${signedIn.user.email}`
+      : "email is optional · add it with --email you@example.com",
+    "email contains only the most recent masked credential exposure",
   ];
 
-  if (prompted) {
+  if (signedIn.prompted) {
     // A sign-in just drew the frame, so the result continues it and the `└`
     // closes both at once — rather than the frame ending and a loose line
     // appearing underneath.
@@ -158,7 +152,7 @@ export async function runScheduleOn(
   // exists to make visible.
   warnIfDaemonWontRun();
 
-  if (prompted) {
+  if (signedIn.prompted) {
     outro("failproofai audit --status  ·  when the next scan is due");
   } else {
     process.stdout.write(dim(`\n   failproofai audit --status   when the next scan is due\n\n`));
@@ -217,7 +211,7 @@ export function runScheduleStatus(): void {
 
   // A session whose refresh window has closed cannot mint another access token,
   // so it is a destination in name only. Showing the address for one would tell
-  // somebody their digests are going somewhere they are not.
+  // somebody their alerts are going somewhere they are not.
   const live = auth && auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
   // Beside the schedule, because they are the two halves of "what does this
   // machine do on its own" — one decides whether it scans, the other whether it
@@ -230,19 +224,9 @@ export function runScheduleStatus(): void {
   detail.push(["reports to", live ? live.user.email : dim("— signed out")]);
   if (on && !live) {
     // The state the reporter surfaces as "signed-out". Named here for the same
-    // reason the settings panel names it: the scans keep running, so silence
-    // about the digests would look like the feature failing.
-    detail.push(["", pink("scans continue; digests are paused until you sign in")]);
-  } else if (on && config.audit.reportsConsentedAt === undefined) {
-    // Signed in, scheduled, and still not sending: this machine set `audit.auto`
-    // when it only meant "scan locally", so nothing has consented to the digest
-    // leaving the box. Without this row the status screen would show a healthy
-    // schedule and a live address and still mail nothing, with no explanation
-    // anywhere the user can see.
-    detail.push([
-      "",
-      pink("scans continue; digests need a fresh opt-in — run `--schedule` to turn them on"),
-    ]);
+    // reason the settings panel names it: the scans and desktop notifications
+    // keep running, so silence about email would look like the feature failing.
+    detail.push(["", pink("scans and desktop alerts continue; email alerts are paused")]);
   }
 
   detail.push(["daemon", describeDaemon(daemon)]);

package/src/audit/types.ts

@@ -217,6 +217,11 @@ export interface AuditResult {
    *  Lets the dashboard answer "is this policy already on?" for
    *  detector-mapped policies that may not have hit during this audit. */
   enabledBuiltinNames: string[];
+  /** Ids of credentials encountered by this scan, including ones already in
+   *  the persistent leak record. Scheduled desktop notifications key on this
+   *  list so every completed scan that still sees a leak can notify; the
+   *  narrower `newLeakIds` remains for first-seen-only surfaces. */
+  leakIds?: string[];
   /**
    * Ids of credentials seen for the FIRST time in this scan.
    *

package/src/hooks/builtin-policies.ts

@@ -138,10 +138,10 @@ const API_KEY_PATTERNS: Array<[RegExp, string]> = [
   // this rule's run would bridge the hyphen in `sk-proj-` and report every
   // project key a second time under the wrong label.
   [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
-  [/sk-svcacct-[A-Za-z0-9\-_]{20,}/, "OpenAI service-account key"],
+  [/(?<!\w)sk-svcacct-[A-Za-z0-9\-_]{20,}/, "OpenAI service-account key"],
   // Highest blast radius in the family: it authenticates the organisation
   // admin surface, and lives at a DIFFERENT console from the other keys.
-  [/sk-admin-[A-Za-z0-9\-_]{20,}/, "OpenAI admin key"],
+  [/(?<!\w)sk-admin-[A-Za-z0-9\-_]{20,}/, "OpenAI admin key"],
 
   // ── OpenAI-compatible gateways ──
   [/sk-or-v1-[A-Za-z0-9\-_]{20,}/, "OpenRouter API key"],

package/src/hooks/configure-wizard.ts

@@ -106,6 +106,7 @@ import {
   type RetryProbe,
 } from "./onboarding-attempt";
 import { acquireOnboardingLock } from "./onboarding-lock";
+import { readConfigRaw, updateConfig } from "./fp-config";
 
 export interface WizardIO {
   stdin?: TTYIn;
@@ -755,6 +756,19 @@ export async function runConfigureWizard(
   // question, and no flag can supply it.
   const preAnswered = Boolean(answers.token);
 
+  // Capture the preference BEFORE the daemon setup writes config.json. A fresh
+  // machine reaches `setDaemonConfigured(true)` with no config file; that helper
+  // necessarily materialises the conservative no-file default (`auto: false`).
+  // Looking after that write cannot distinguish "the user switched it off"
+  // from "setup just wrote its fallback", which is how new installs ended up
+  // with a seven-day scheduler that was explicitly disabled.
+  const initialAudit = readConfigRaw().raw.audit;
+  const hadExplicitAuditAuto =
+    !!initialAudit &&
+    typeof initialAudit === "object" &&
+    !Array.isArray(initialAudit) &&
+    typeof (initialAudit as Record<string, unknown>).auto === "boolean";
+
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
   // does it silently: homedir() becomes /root, so the hooks land in root's
@@ -1439,6 +1453,20 @@ export async function runConfigureWizard(
   // binary filename are both derived from it.
   if (daemonInstalled) {
     setDaemonConfigured(true, cliVersion);
+    // A completed setup is the default opt-in to the LOCAL seven-day scan. It
+    // does not imply an email address or make a network request: reporting is
+    // independently gated by the signed-in audit identity. Reconfiguration
+    // preserves an explicit `auto: false`, so the user's off switch remains an
+    // off switch instead of being undone whenever they repair or upgrade the
+    // daemon.
+    if (!hadExplicitAuditAuto) {
+      try {
+        updateConfig({ audit: { auto: true } });
+      } catch {
+        // The daemon and hooks are already installed. Keep setup successful;
+        // the status screen will expose that scheduling could not be persisted.
+      }
+    }
     // Only now — the unit points at the new binary, so older ones are no
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.
@@ -1461,7 +1489,14 @@ export async function runConfigureWizard(
     // missing or launchd refuses the job must still finish installing its
     // daemon, its hooks and its policies, which are the parts that enforce
     // anything; the notice in-CLI still reaches them either way.
-    installMacNotifier();
+    const notifier = installMacNotifier();
+    if (process.platform === "darwin" && !notifier.installed) {
+      hookLogWarn(`macOS notification helper was not installed: ${notifier.reason ?? "unknown error"}`);
+      stdout.write(
+        "\nSystem notifications could not be installed. Scheduled scans and email alerts\n" +
+          "still work; re-run `failproofai config` after checking the local LaunchAgent.\n\n",
+      );
+    }
   }
 
   // Telemetry runs concurrently with the install (never rejects, 5s-bounded) so

package/src/hooks/fp-config.ts

@@ -308,22 +308,15 @@ export interface FpConfig {
   };
   audit: {
     /**
-     * Scan this machine on a schedule, and mail a digest when a scan finds
-     * something harmful.
+     * Scan this machine on a schedule. Delivery is deliberately separate:
+     * desktop notifications are controlled by `notify`, while a verified local
+     * email identity adds email alerts without changing the timer.
      *
-     * ONE switch, not two. An earlier revision split this into `auto` (scan
-     * locally, no account) and `email_enabled` (mail me, sign in), and the two
-     * could only ever disagree — a machine scanning on a timer with nothing to
-     * report it to is a feature that looks on and does nothing visible. The
-     * reason to put a scan on a timer is to be TOLD, so scheduling and mailing
-     * are the same decision and take the same switch.
-     *
-     * A signed-out machine with this on is therefore a real, expected state
-     * rather than a contradiction: it keeps scanning and keeps its local
-     * dashboard current, and the UI says "signed out" until somebody signs back
-     * in. Auth gates SETTING it up, never the machine's ongoing work — a
-     * refresh token expiring must not silently switch off a background feature
-     * somebody configured months ago.
+     * A signed-out machine with this on is therefore the normal local-only
+     * state rather than a contradiction: it keeps scanning, keeps its local
+     * dashboard current, and raises desktop notifications for credential leaks.
+     * A refresh token expiring must not silently switch off a background
+     * security feature.
      *
      * ON for a configured machine that has never stated an opinion, OFF for
      * every machine we could not read an opinion from — which is not the same
@@ -345,9 +338,9 @@ export interface FpConfig {
      * agree, or the settings page describes a machine that is doing something
      * else.
      *
-     * Turning it on sends NOTHING on its own: the digest is gated on
-     * `reportsConsentedAt` below, not on this switch, so a machine that flips
-     * on at upgrade scans locally and mails nobody.
+     * Turning it on sends nothing remotely on its own. Email requires a valid
+     * identity in `audit/session.json`; without one, scans and notifications
+     * remain fully local.
      */
     auto: boolean;
     /**
@@ -358,40 +351,22 @@ export interface FpConfig {
      * wants the scan and not the banner is a coherent person, and without this
      * their only way to stop the banner is to stop the scan.
      *
-     * ON by default, and the direction is the point: this fires at most once
-     * per distinct credential ever (`leak-notice.ts` claims each finding with
-     * an O_EXCL marker), so the volume it can reach is bounded by how many
-     * secrets are actually leaking. A silent default would make the common
-     * case — a user who never opens the dashboard and never gave an email —
-     * a machine that finds the key and tells nobody.
+     * ON by default. Every scheduled scan that still sees a leak may notify,
+     * which keeps a credential that remains exposed from disappearing after
+     * its first alert. A silent default would make the common case — a user who
+     * never opens the dashboard and never gave an email — a machine that finds
+     * the key and tells nobody.
      *
-     * It does NOT silence the in-CLI notice. That one appears inside a session
-     * the user is already driving, costs two lines, and is the only channel
-     * left when there is no desktop to notify — a headless box, a container, an
-     * SSH session. Turning off every channel at once is not an option this
-     * offers, because the resulting state is indistinguishable from broken.
+     * On a headless box, container or SSH-only session there may be no desktop
+     * server to receive the banner. The scheduled scan still completes and
+     * records its result; notification failure never changes the scan outcome.
      */
     notify: boolean;
     /**
-     * When this machine's owner agreed that a scheduled scan may send what it
-     * finds off the box, as epoch ms. Absent means they never did.
-     *
-     * This does NOT reintroduce the second switch the comment above rejects,
-     * and it is never drawn as one. `auto` is what a person sets; this is a
-     * record of the disclosure they were shown when they set it. The two cannot
-     * drift, because every path that turns `auto` on stamps this in the same
-     * call and nothing stamps it alone.
-     *
-     * It exists because `auto` CHANGED MEANING. Through 1.0.0 it meant "scan
-     * this machine on a timer" and nothing more — no account, no network, and
-     * the toggle that wrote it said as much in as many words. Harm digests gave
-     * the same stored bit a second job: uploading redacted transcript excerpts
-     * to the api-server and mailing them. Without a separate record, every
-     * machine that opted into the old meaning would have started sending on
-     * upgrade, having agreed to nothing of the kind, with the only notice a
-     * line in the journal. Gating on the stamp rather than the switch is what
-     * keeps that upgrade silent in the safe direction: those machines keep
-     * scanning locally and send nothing until somebody opts in again.
+     * Legacy migration marker from the earlier harm-digest consent model.
+     * Retained when reading and writing old configs so upgrades are lossless,
+     * but it no longer gates scheduling or credential-alert email. A verified
+     * email identity is now the delivery opt-in.
      */
     reportsConsentedAt?: number;
     /** Days between scheduled runs. Wall clock, so it survives suspend. */
@@ -587,8 +562,8 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
         // question is only whether to speak.
         notify: audit.notify !== false,
         intervalDays: readIntervalDays(audit.interval_days),
-        // A finite number or nothing. A garbage value reads as absent, which is
-        // the direction that sends nothing.
+        // Preserve the legacy marker when it is valid; current behavior does
+        // not consult it.
         reportsConsentedAt:
           typeof audit.reports_consented_at === "number" &&
           Number.isFinite(audit.reports_consented_at)
@@ -738,7 +713,8 @@ export function writeConfig(config: FpConfig, raw?: Record<string, unknown>): vo
     ...(config.telemetry.enabled ? {} : { telemetry: { enabled: false } }),
     // Written ALWAYS, unlike telemetry directly above — the two are opposites
     // on purpose. Telemetry ships on and is deliberately not advertised;
-    // the scheduled audit ships off and is meant to be FOUND, and a switch
+    // the scheduled audit is configured during setup and is meant to be FOUND,
+    // and a switch
     // nobody can see is the same as a switch that does not exist. Emitting both
     // keys unconditionally also makes "a user's setting survives a rewrite"
     // total rather than conditional.
@@ -749,9 +725,8 @@ export function writeConfig(config: FpConfig, raw?: Record<string, unknown>): vo
       // exists to be found by somebody the banner annoyed.
       notify: config.audit.notify,
       interval_days: config.audit.intervalDays,
-      // Written only once there IS consent, so an untouched machine's config
-      // does not grow a key implying it was asked. It is in
-      // `OWNED_CONFIG_KEYS`, so omitting it here really removes it.
+      // Preserve the legacy consent marker when present. It is not used by the
+      // current local-schedule + optional-email model.
       ...(config.audit.reportsConsentedAt === undefined
         ? {}
         : { reports_consented_at: config.audit.reportsConsentedAt }),

package/src/hooks/handler.ts

@@ -35,8 +35,6 @@ import { loadAllCustomHooks } from "./custom-hooks-loader";
 import type { CustomHook } from "./policy-types";
 import { persistHookActivity } from "./hook-activity-store";
 import { deliveryHealth, deliveryHealthLine } from "./delivery-health";
-import { shapeNotice, canDeliverNotice, leakNoticeText } from "./notice";
-import { sessionNoticePending, markSessionNoticed } from "../audit/leak-notice";
 import { trackHookEvent, flushHookTelemetry } from "./hook-telemetry";
 import { resolveCwd } from "./resolve-cwd";
 import { resolvePermissionMode } from "./resolve-permission-mode";
@@ -106,67 +104,6 @@ export interface HookEventOutcome {
   stderr: string;
 }
 
-/**
- * Merge a pending leak notice into an outcome, once.
- *
- * Anchored on Stop wherever the host renders there, and SessionStart only where
- * it does not: Stop fires once per turn, AFTER the answer, so it never
- * interrupts what the user was reading — and at session open the background
- * scan may not have produced the finding yet.
- *
- * Every failure is swallowed. A courtesy message must never be the reason a
- * hook misbehaves, and the finding is on disk either way.
- */
-function attachLeakNotice(
-  eventType: string,
-  cli: IntegrationType | undefined,
-  outcome: HookEventOutcome,
-  sessionId: string | undefined,
-): HookEventOutcome {
-  try {
-    if (!canDeliverNotice(cli)) return outcome;
-    // canDeliverNotice() above already proved cli is set; narrow for the call.
-    if (!cli) return outcome;
-    const canonical = canonicalizeEventType(eventType, cli);
-    // STOP ONLY, and the narrowing is the fix for a measured failure rather
-    // than caution. `notice.ts` derived each host's channel from a live probe
-    // on **Stop**; SessionStart was allowed here on the assumption that a
-    // channel proven on one event works on another. It does not. On a real
-    // machine 499 findings were CLAIMED and the user saw nothing: SessionStart
-    // fires first in a session, consumed every claim, and the host dropped the
-    // field — Claude Code documents `hookSpecificOutput.additionalContext` for
-    // SessionStart, not `systemMessage`.
-    //
-    // That is the worst outcome this design has: a finding recorded as
-    // delivered that reached nobody, and never retried. Stop fires at the end
-    // of every assistant turn, so nothing is lost by waiting for it — the user
-    // is reading output at that moment anyway. Add SessionStart back only with
-    // a probe showing the notice actually rendered there.
-    if (canonical !== "Stop") return outcome;
-
-    // Keyed on the SESSION and on whether the user has opened the report, not
-    // on a per-finding "we emitted this once" marker — see
-    // `sessionNoticePending` for the two ways that marker lost the alert
-    // permanently. A dropped notice now costs one session's silence instead.
-    const pending = sessionNoticePending(sessionId ?? "");
-    if (pending.count === 0) return outcome;
-
-    const shaped = shapeNotice(cli, leakNoticeText(pending.count), outcome.stdout);
-    if (shaped.stdout === outcome.stdout && !shaped.stderr) return outcome;
-
-    // Claimed only once the notice is actually on the stream, so a crash
-    // between the two re-notifies rather than silently swallowing the alert.
-    markSessionNoticed(sessionId ?? "");
-    return {
-      exitCode: outcome.exitCode,
-      stdout: shaped.stdout,
-      stderr: outcome.stderr + shaped.stderr,
-    };
-  } catch {
-    return outcome;
-  }
-}
-
 export interface EvaluateHookEventOptions {
   /**
    * Await pending telemetry POSTs before returning. Defaults to `true`,
@@ -820,22 +757,7 @@ export async function evaluateHookEvent(
       }
     }
 
-    // Attach a pending leak notice, if this event is one that can carry it.
-    //
-    // Emitted HERE rather than in `handleHookEvent`, which is what fixes the
-    // bug this replaced: `bin/failproofai.mjs`'s `isDaemonConfigured()` branch
-    // writes `result.stdout`/`result.stderr` and EXITS INSIDE THAT BRANCH — it
-    // never falls through to `handleHookEvent`. Setup requires the daemon, so
-    // the previous notice was dead code on every configured machine, and had
-    // been since it shipped. Both paths return this object, so producing the
-    // notice here reaches both with no change to either caller.
-    const withNotice = attachLeakNotice(
-      eventType,
-      cli,
-      { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr },
-      sessionId,
-    );
-    return withNotice;
+    return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
   } finally {
     if (opts?.awaitTelemetryFlush ?? true) {
       // Await any un-awaited (`void trackHookEvent(...)`) events fired during

package/src/hooks/integrations.ts

@@ -784,7 +784,6 @@ export const cursor: Integration = {
 //   • exit 2 OR `permissionDecision: "deny"` → `throw new Error(reason)`
 //     (which OpenCode surfaces as a tool-call failure to the agent)
 //   • `additionalContext` → `client.session.prompt(...)` (fire-and-forget)
-//   • `failproofaiNotice` → `client.tui.showToast(...)` (user-visible)
 //   • everything else → no-op (allow)
 //
 // Settings paths:
@@ -957,19 +956,6 @@ async function applyDecision(result, ctx, eventName) {
   if (out && out.decision && out.decision.behavior === "deny") {
     throw new Error((out.decision.message) || "Blocked by failproofai");
   }
-  const notice = parsed.failproofaiNotice;
-  if (typeof notice === "string" && notice && ctx && ctx.client && ctx.client.tui) {
-    try {
-      await ctx.client.tui.showToast({
-        body: {
-          title: "failproofai audit",
-          message: notice,
-          variant: "warning",
-          duration: 12_000,
-        },
-      });
-    } catch { /* a courtesy notice must never break the host hook */ }
-  }
   // Forward additional context as a prompt to the session. For Stop /
   // SubagentStop the prompt is the only force-retry channel (session.idle
   // already fired), so AWAIT to ensure the SDK round-trip completes before
@@ -1025,7 +1011,10 @@ export default async function failproofaiPlugin({ client, directory }) {
       const claudeEvent = BUS_EVENT_MAP[event.type];
       if (!claudeEvent) return;
       const props = event.properties || {};
-      const sessionID = props.sessionID || (props.session && props.session.id) || props.id;
+      const info = props.info || props.session || {};
+
+      const sessionID = info.id || info.sessionID || info.sessionId || info.session_id ||
+        props.sessionID || props.sessionId || props.session_id || props.id;
       const r = await runFailproofai(claudeEvent, {
         session_id: sessionID, cwd: directory, hook_event_name: claudeEvent,
       }, directory);