failproofai 1.0.4-beta.7 → 1.0.4

package/lib/cursor-sessions.ts

@@ -127,15 +127,7 @@ interface CursorRecord {
   /** Cursor 2026-04+ transcript shape: `{role, message: {content: [...]}}`. */
   role?: "user" | "assistant" | "system" | string;
   message?: {
-    content?: Array<{
-      type?: string;
-      text?: string;
-      id?: string;
-      name?: string;
-      input?: Record<string, unknown>;
-      tool_use_id?: string;
-      content?: unknown;
-    }>;
+    content?: Array<{ type?: string; text?: string }>;
   };
 }
 
@@ -191,36 +183,11 @@ export async function parseCursorLog(
     if (!raw.type && raw.role && raw.message?.content) {
       const synthDate = new Date(SYNTH_T0 + i);
       const synthTs = synthDate.toISOString();
-      const messageContent = raw.message.content;
-      const textParts = messageContent
+      const textParts = raw.message.content
         .filter((c) => c?.type === "text" && typeof c.text === "string")
         .map((c) => c.text!)
         .join("");
       if (raw.role === "user") {
-        // Some Cursor builds emit Claude-style tool_result blocks in the next
-        // user record. Pair them before treating any remaining text as a user
-        // turn so command output is available to the credential scanner.
-        let attachedResult = false;
-        for (const block of messageContent) {
-          if (block?.type !== "tool_result") continue;
-          const callId = typeof block.tool_use_id === "string" ? block.tool_use_id : undefined;
-          const toolUse = callId ? toolUseById.get(callId) : undefined;
-          if (!toolUse) continue;
-          const durationMs = Math.max(
-            0,
-            synthDate.getTime() - (toolUseStartMs.get(callId!) ?? synthDate.getTime()),
-          );
-          toolUse.result = {
-            timestamp: synthTs,
-            timestampFormatted: formatTimestamp(synthDate),
-            content: typeof block.content === "string"
-              ? block.content
-              : block.content == null ? "" : JSON.stringify(block.content),
-            durationMs,
-            durationFormatted: formatDuration(durationMs),
-          };
-          attachedResult = true;
-        }
         // Strip the synthesized `<timestamp>...</timestamp>\n<user_query>...\n</user_query>`
         // wrapper Cursor adds for context — keep just the user_query body.
         const queryMatch = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/.exec(textParts);
@@ -231,37 +198,13 @@ export async function parseCursorLog(
             ...baseEntry(rawCopy, synthTs, synthDate, source),
             message: { role: "user", content: text },
           } satisfies UserEntry);
-        } else if (!attachedResult) {
-          entries.push({
-            type: "system",
-            ...baseEntry(rawCopy, synthTs, synthDate, source),
-            raw: rawCopy,
-          } satisfies GenericEntry);
         }
         continue;
       }
       if (raw.role === "assistant") {
-        const blocks: ContentBlock[] = [];
-        if (textParts) blocks.push({ type: "text", text: textParts });
-        for (let j = 0; j < messageContent.length; j++) {
-          const contentBlock = messageContent[j];
-          if (contentBlock?.type !== "tool_use") continue;
-          const name = typeof contentBlock.name === "string" ? contentBlock.name : "tool";
-          const id = typeof contentBlock.id === "string" && contentBlock.id
-            ? contentBlock.id
-            : `cursor-${i}-${name}-${j}`;
-          const toolUse: ToolUseBlock = {
-            type: "tool_use",
-            id,
-            name,
-            input: contentBlock.input && typeof contentBlock.input === "object"
-              ? contentBlock.input
-              : {},
-          };
-          blocks.push(toolUse);
-          toolUseById.set(id, toolUse);
-          toolUseStartMs.set(id, synthDate.getTime());
-        }
+        const blocks: ContentBlock[] = textParts
+          ? [{ type: "text", text: textParts }]
+          : [];
         if (blocks.length === 0) {
           entries.push({
             type: "system",

package/lib/sqlite-reader.ts

@@ -39,42 +39,8 @@ interface NodeSqliteModule {
   DatabaseSync: new (path: string, options?: { readOnly?: boolean }) => NodeSqliteDb;
 }
 
-/**
- * Swallow Node's "SQLite is an experimental feature" warning, once.
- *
- * It is not information the user can act on — we chose `node:sqlite`
- * deliberately, and the alternative tier is a WASM build that leaks. But it is
- * emitted on first use, which lands it in the MIDDLE of whatever is on screen,
- * and the audit's progress display redraws itself by moving the cursor up a
- * fixed number of lines. Two unexpected lines of stderr push the cursor down
- * two rows, so the next redraw repaints the block two rows lower and strands
- * the top of the previous frame above it. The user sees every stage twice and
- * reasonably concludes the audit ran twice.
- *
- * Filtered by message rather than silenced wholesale: `process.emitWarning` is
- * how deprecations and real problems surface too, and a blanket
- * `NODE_NO_WARNINGS` in a tool that installs into other people's machines would
- * hide those as well.
- */
-let warningPatched = false;
-function silenceSqliteExperimentalWarning(): void {
-  if (warningPatched) return;
-  warningPatched = true;
-  const original = process.emitWarning.bind(process);
-  // The overloads differ across Node versions; the shape we care about is the
-  // first argument, and everything else is passed straight through.
-  process.emitWarning = ((warning: unknown, ...rest: unknown[]) => {
-    const text = typeof warning === "string" ? warning : String((warning as Error)?.message ?? "");
-    if (text.includes("SQLite is an experimental feature")) return;
-    return (original as (...a: unknown[]) => void)(warning, ...rest);
-  }) as typeof process.emitWarning;
-}
-
 async function tryNodeSqlite(dbPath: string): Promise<SqliteReader | null> {
   try {
-    // Before the import, not after: the warning fires on first use of the
-    // module, which is this line.
-    silenceSqliteExperimentalWarning();
     // Dynamic import: on Node < 22.5 this rejects and we fall through to sql.js.
     const mod = (await import("node:sqlite")) as unknown as NodeSqliteModule;
     const db = new mod.DatabaseSync(dbPath, { readOnly: true });
@@ -100,53 +66,10 @@ function loadSqlJs(): Promise<SqlJsStatic> {
   return sqlPromise;
 }
 
-const SQLITE_MAGIC = "SQLite format 3\0";
-
-/**
- * Clear the WAL flag on OUR OWN in-memory copy of the database image.
- *
- * Header bytes 18 and 19 are the file-format write and read versions; `2`
- * means WAL. sql.js never sees the `-wal` sidecar — it is handed the main
- * file's bytes and nothing else, which is exactly the snapshot caveat this
- * module already documents — so the flag buys us nothing, and it costs a great
- * deal: opening a WAL-flagged image makes SQLite build a wal-index
- * shared-memory region that sql.js's MEMFS-backed VFS never reclaims on
- * `close()` (close unlinks only the db file it created).
- *
- * The asm.js build's heap is a FIXED 22,151,168-byte ArrayBuffer with
- * ALLOW_MEMORY_GROWTH off, so `emscripten_resize_heap` is compiled to
- * `abort("OOM")`. Measured: the 128th WAL-mode open exhausts it — the same
- * threshold for a 319 KB database and a 10 MB one, because the leaked region
- * is a fixed per-connection allocation rather than data.
- *
- * And the abort is not confined to that open. `initSqlJs` memoizes one
- * process-wide module, so once it aborts every later `openSqliteReadonly`
- * silently returns null. A full audit opens ~150 databases — devin, goose and
- * opencode each open theirs once per SESSION — so it crossed 128 and then
- * dropped whatever it had not yet read, with no error anywhere. The
- * `Aborted(OOM)` lines on stderr were the only symptom, and they read as
- * harmless because the run still completed.
- *
- * Only under bun and Node < 22.5: tier 1 is `node:sqlite`, which bun does not
- * provide, and `engines.node` allows 20.9. Both fall through to here.
- */
-function clearWalFlag(bytes: Buffer): Buffer {
-  // Too short to carry a header, or not a SQLite image at all — hand it back
-  // untouched and let sql.js produce its own error.
-  if (bytes.length < 20) return bytes;
-  if (bytes.toString("latin1", 0, 16) !== SQLITE_MAGIC) return bytes;
-  if (bytes[18] === 1 && bytes[19] === 1) return bytes; // already rollback-journal
-  bytes[18] = 1;
-  bytes[19] = 1;
-  return bytes;
-}
-
 async function trySqlJs(dbPath: string): Promise<SqliteReader | null> {
   try {
     const SQL = await loadSqlJs();
-    // `readFileSync` already returns a private copy, so mutating the two header
-    // bytes cannot touch the file on disk.
-    const db = new SQL.Database(clearWalFlag(readFileSync(dbPath)));
+    const db = new SQL.Database(readFileSync(dbPath));
     return {
       query<T = Record<string, unknown>>(sql: string, params?: unknown[]): T[] {
         const stmt = db.prepare(sql);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.4-beta.7",
+  "version": "1.0.4",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -121,15 +121,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.7",
-    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.7",
-    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.7",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.7"
+    "@failproofai/failproofaid-linux-x64": "1.0.4",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4"
   },
   "failproofaidBinaries": {
-    "linux-x64": "e59735a8f94cd8ac697b2bd67aafdd8d76a8394d53db229876980cc13a18f07e",
-    "linux-arm64": "b9ce50dd2f79b55f4f7112add265a776a4a6d002c2a56f971e666fbb796f3906",
-    "darwin-x64": "b46efc8ec33945a5cc26b7bb288fb87cea65b5983bd83094b5e607d53b8eda4c",
-    "darwin-arm64": "a8cc6112cee5ca8a7d517900e9ce32118855135980f22979fa0ff7aa6f68d954"
+    "linux-x64": "cca1d41ff951784ba084bf2d72cfad0fe8d988f8226e0e7a4538b1fb8d76a5bd",
+    "linux-arm64": "55e9c1e2864cbf6057fd0c27e4bc573ca8fba2cd35d480a3db3a55d398e7bec0",
+    "darwin-x64": "2a46ec77d2cac14a036f35e832f92f16895239814a5f10f02121f3c313e70574",
+    "darwin-arm64": "a0e7ccc6fe24e1017592637192ba8a26c9d05ca839c98bc72a983094c863b39b"
   }
 }

package/pi-extension/index.ts

@@ -25,7 +25,7 @@
  * spawns extensions with an undefined cwd contract, so paths are resolved
  * relative to this file via `import.meta.url`, NOT process.cwd().
  */
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readdirSync, statSync } from "node:fs";
@@ -64,47 +64,6 @@ function debug(msg: string): void {
   }
 }
 
-/**
- * Forward an event whose VERDICT NOBODY READS, without blocking Pi.
- *
- * `callPolicy` is `spawnSync`, and Pi awaits its handlers serially on the
- * startup path — so a `session_start` forward froze the whole TUI for as long
- * as the subprocess took (measured floor 1.0-1.6s just to boot the binary,
- * ceiling the full 60s timeout) and then threw the answer away. Three call
- * sites are like that by design: `session_start`, `tool_result` and
- * `session_shutdown` forward for the activity feed and for session-id
- * continuity, and Pi cannot act on their return in any case
- * (`ToolResultEventResult` has no `block`; the other two have no Result type
- * at all).
- *
- * So they get a detached `spawn` instead. The event still reaches failproofai,
- * the policies still run and still log, and Pi keeps rendering. Deliberately
- * NOT used for `tool_call`, `user_bash`, `input` or `agent_end`: those four
- * consume the decision, and blocking is what enforcement means.
- */
-function forwardPolicy(
-  eventName: string,
-  payload: unknown,
-): void {
-  const { cmd, args } = resolveSpawn();
-  debug(`forwardPolicy (detached) event=${eventName} cmd=${cmd}`);
-  try {
-    const child = spawn(cmd, [...args, "--hook", eventName, "--cli", "pi"], {
-      stdio: ["pipe", "ignore", "ignore"],
-      detached: false,
-    });
-    // A child that outlives its parent's interest must not keep the event loop
-    // alive, or Pi cannot exit until the subprocess does.
-    child.unref();
-    // EPIPE if the child died before stdin was consumed — fail-open, silently.
-    child.on("error", (err) => debug(`forward error ${err.message}`));
-    child.stdin?.on("error", () => {});
-    child.stdin?.end(JSON.stringify(payload));
-  } catch (err) {
-    debug(`FORWARD EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
-  }
-}
-
 function callPolicy(eventName: string, payload: unknown): { block: boolean; reason: string } {
   const { cmd, args } = resolveSpawn();
   debug(`callPolicy event=${eventName} cmd=${cmd}`);
@@ -124,12 +83,8 @@ function callPolicy(eventName: string, payload: unknown): { block: boolean; reas
     const parsed = JSON.parse(stdout) as PolicyDecision;
     if (parsed.permission === "deny") {
       debug(`DENY reason=${parsed.reason}`);
-      return {
-        block: true,
-        reason: parsed.reason ?? "Blocked by failproofai",
-      };
+      return { block: true, reason: parsed.reason ?? "Blocked by failproofai" };
     }
-    return { block: false, reason: "" };
   } catch (err) {
     debug(`EXCEPTION ${err instanceof Error ? err.message : String(err)}`);
     // Fail-open: never block tool execution because of an infra failure.
@@ -462,7 +417,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   // need session_id continuity see the metadata.
   pi.on("session_start", (event: unknown): unknown => {
     const e = event as PiSessionStartEvent;
-    forwardPolicy("session_start", {
+    callPolicy("session_start", {
       session_id: resolveSessionId(e.sessionId, resolveCwd(e.cwd)),
       cwd: resolveCwd(e.cwd),
       reason: e.reason,
@@ -480,7 +435,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   pi.on("tool_result", (event: unknown): unknown => {
     const e = event as PiToolResultEvent;
     const canonicalTool = canonicalizeToolName(e.toolName);
-    forwardPolicy("tool_result", {
+    callPolicy("tool_result", {
       tool_name: canonicalTool,
       tool_input: canonicalizeToolInput(canonicalTool, e.input) ?? {},
       tool_response: { content: e.content, isError: e.isError },
@@ -545,7 +500,7 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
   pi.on("session_shutdown", (event: unknown): unknown => {
     const e = event as PiSessionShutdownEvent;
     const cwd = resolveCwd(e.cwd);
-    forwardPolicy("session_shutdown", {
+    callPolicy("session_shutdown", {
       session_id: resolveSessionId(e.sessionId, cwd),
       cwd,
       reason: e.reason,

package/src/audit/cache.ts

@@ -14,7 +14,6 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, openSync
 import { join } from "node:path";
 import { BUILTIN_POLICIES } from "../hooks/builtin-policies";
 import { AUDIT_DETECTORS } from "./detectors";
-import { LEAK_SCAN_VERSION } from "./leak-scan";
 import type { TranscriptAuditResult, DetectorSessionState } from "./types";
 import { auditCacheDir } from "../hooks/fp-home";
 
@@ -163,9 +162,6 @@ interface CacheEntry {
   sizeBytes: number;
   engineVersion: string;
   detectorVersion: string;
-  /** Separate because leak detection is neither a builtin policy nor one of
-   * the behavioural AUDIT_DETECTORS hashed above. */
-  leakScanVersion: number;
   result: TranscriptAuditResult;
   /**
    * How far into the file the recorded result actually accounts for, at a LINE
@@ -273,7 +269,6 @@ export function readCachedTranscript(
     if (entry.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
     if (entry.engineVersion !== getEngineVersion()) return null;
     if (entry.detectorVersion !== getDetectorVersion()) return null;
-    if (entry.leakScanVersion !== LEAK_SCAN_VERSION) return null;
     // Number.isFinite (not typeof) so a malformed JSON `Infinity` /
     // `NaN` is rejected — those would otherwise bypass the TTL check
     // and pin a stale entry as valid forever.
@@ -337,7 +332,6 @@ export function writeCachedTranscriptResult(
       sizeBytes,
       engineVersion: getEngineVersion(),
       detectorVersion: getDetectorVersion(),
-      leakScanVersion: LEAK_SCAN_VERSION,
       result,
     };
     if (resume && resume.bytesScanned > 0) {

package/src/audit/cli-adapters/claude.ts

@@ -6,7 +6,6 @@
  * parses each via lib/log-entries.ts.
  */
 import { readFile, open, type FileHandle } from "node:fs/promises";
-import { readFileSync } from "node:fs";
 import {
   listClaudeProjects,
   listClaudeTranscripts,
@@ -41,17 +40,6 @@ export async function listClaudeTranscriptMetadata(
     }
     for (const t of transcripts) {
       if (t.mtimeMs < sinceMs) continue;
-      let sessionDescription: string | undefined;
-      if (t.isSubagent) {
-        try {
-          const meta = JSON.parse(
-            readFileSync(t.transcriptPath.replace(/\.jsonl$/, ".meta.json"), "utf8"),
-          ) as { description?: unknown };
-          if (typeof meta.description === "string") sessionDescription = meta.description;
-        } catch {
-          // Sidecars are optional (journal transcripts do not have one).
-        }
-      }
       out.push({
         cli: "claude",
         projectName: project.name,
@@ -59,7 +47,6 @@ export async function listClaudeTranscriptMetadata(
         transcriptPath: t.transcriptPath,
         mtimeMs: t.mtimeMs,
         sizeBytes: t.sizeBytes,
-        sessionDescription,
       });
     }
   }

package/src/audit/cli-login.ts

@@ -173,10 +173,7 @@ export async function ensureSignedIn(preset?: string): Promise<EnsureSignedIn> {
     throw new LoginError(
       "Signing in needs an interactive terminal, and this one is not.\n" +
         "Run `failproofai audit --schedule` from a shell you are sitting at,\n" +
-        "or sign in from the dashboard — both write the same session file.\n" +
-        "\n" +
-        "`--email` does not avoid this: it fills in the address so you are not\n" +
-        "asked for it, but a one-time code is still sent there for you to paste.",
+        "or sign in from the dashboard — both write the same session file.",
     );
   }
 

package/src/audit/cli.ts

@@ -3,7 +3,7 @@
  * the dashboard to view it.
  *
  *   failproofai audit                Scan, then launch the dashboard at /audit.
- *   failproofai audit --schedule     Put local scans and notifications on a timer.
+ *   failproofai audit --schedule     Put scans on a timer and mail the findings.
  *   failproofai audit --no-schedule  Stop the timer.
  *   failproofai audit --status       What this machine is scheduled to do.
  *   failproofai audit -h, --help     Show usage.
@@ -35,11 +35,6 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { sanitizeErrorMessage } from "../../lib/telemetry-sanitize";
 import { openWhenReady } from "./open-browser";
 import { describeOutcome, reportHarm } from "./report-harm";
-import { notifyDesktop } from "./desktop-notify";
-import { macNotifierInstalled, pruneMacNotifyQueue, queueMacNotification } from "./macos-notifier";
-import { desktopLeakNotice, type DesktopLeakEmailState } from "../hooks/notice";
-import { readConfig } from "../hooks/fp-config";
-import { readAuth } from "../../lib/auth/auth-store";
 import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM, helpScreen, helpOptsFor } from "../hooks/tui";
 import { version } from "../../package.json";
 
@@ -97,36 +92,26 @@ export function helpText(): string {
     {
       command: "audit",
       version,
-      tagline: "find credentials your agents leaked into their own transcripts",
+      tagline: "review your agent CLIs for risky and wasteful patterns",
       sections: [
         {
           label: "usage",
           entries: [
-            ["(bare)", `Scan your session history for leaked keys, then open http://localhost:${DASHBOARD_PORT}/audit`],
-            ["--schedule [days]", "Scan on a timer and notify you on this machine. Default 7 days, range 1-90. No account required."],
+            ["(bare)", `Scan your session history, then open http://localhost:${DASHBOARD_PORT}/audit`],
+            ["--schedule [days]", "Scan on a timer and email the findings. Default 7 days, range 1-90. Signs you in the first time."],
             // Its own row now, rather than a clause inside --schedule's. It
             // does not stand alone, which is why it used to be a clause — but
             // a clause wraps, and `--email <address>` landing with the flag at
             // the end of one line and its placeholder at the start of the next
             // is not a flag anybody can read or copy.
-            ["--email <address>", "With --schedule, add email alerts for the most recent masked credential leak. A sign-in code is emailed to you."],
+            ["--email <address>", "With --schedule, skips the sign-in prompt."],
             ["--no-schedule", "Stop the timer. Leaves you signed in."],
-            // Its own pair of flags rather than a clause on --schedule: whether
-            // this machine scans and whether it may interrupt you are separate
-            // decisions, and nobody silencing a banner should have to re-state
-            // their schedule to do it.
-            ["--notify", "Show a desktop notification when a scan finds a credential. On by default."],
-            ["--no-notify", "Stop desktop notifications. Scheduled scans and optional email alerts are unaffected."],
             ["--status", "Whether scheduling is on, where reports go, the daemon's state, and when the next scan is due."],
             ["-h, --help", "Show this help."],
           ],
         },
       ],
-      footer: [
-        "Every scan runs on this machine. Leak alerts appear as desktop system",
-        "notifications, never inside agent sessions. If you add email, only the",
-        "newest masked credential exposure and its metadata leave the machine.",
-      ],
+      footer: ["Everything runs on this machine; only a scheduled digest ever leaves it."],
     },
     helpOptsFor(process.stdout),
   );
@@ -214,18 +199,6 @@ function startProgress(): Progress {
     const lines = Array.from({ length: n }, (_, i) => lineFor(i));
     // Move the cursor back up over the previously-drawn block, then clear and
     // rewrite each line in place.
-    //
-    // INVARIANT: nothing else may write to the terminal while this is running.
-    // The cursor-up is a fixed count, so any stray line pushes the cursor down
-    // and the next redraw repaints the block lower — stranding the top of the
-    // old frame above it, which reads as the audit having run twice. That is
-    // not hypothetical: Node's "SQLite is an experimental feature" warning did
-    // exactly this on every first run, two lines of it, and it is why
-    // `lib/sqlite-reader.ts` now filters that one warning at the source.
-    //
-    // There is no defensive fix from inside here — erasing to end of screen
-    // still leaves the stranded lines ABOVE the cursor. Keep the terminal
-    // quiet instead.
     if (printed) process.stdout.write(`\x1b[${n}A`);
     process.stdout.write(lines.map((l) => `\x1b[2K${l}`).join("\n") + "\n");
     printed = true;
@@ -361,116 +334,6 @@ function heldByLine(held: AuditLockInfo | null): string {
   return `another audit is already running (pid ${held.pid}, started by ${held.source} ${ageS}s ago)`;
 }
 
-/**
- * Raise a desktop banner for credentials this scan found and nothing has
- * announced yet.
- *
- * Scheduled runs only, and the reason is the same one that keeps `reportHarm`
- * here: an interactive `failproofai audit` prints its findings to a person who
- * is already looking at them, so a banner on top is noise. The scheduled run is
- * the one with nobody watching, which is exactly when a notification is the
- * only thing that reaches anyone.
- *
- * Every failure is swallowed on purpose. This is an announcement about a
- * completed scan, not part of the scan: a machine with no desktop, a locked
- * session, a bus that hung — none of those make the audit itself a failure, and
- * turning a good scan into exit 1 would make the scheduler back off from
- * running the thing that actually matters.
- */
-async function announceLeaksOnDesktop(
-  result: AuditResult,
-  report: Awaited<ReturnType<typeof reportHarm>>,
-): Promise<void> {
-  try {
-    await announceLeaksOrThrow(result, report);
-  } catch (err) {
-    // The catch is not decoration. `notifyDesktop` documents that it never
-    // throws, but it is doing socket I/O, and so are the config read and the
-    // marker write beside it — depending on three modules' promises to keep a
-    // completed scan from reporting failure is a dependency this does not need
-    // to have.
-    process.stderr.write(
-      `failproofai: could not announce a leak on the desktop: ` +
-        `${err instanceof Error ? err.message : String(err)}\n`,
-    );
-  }
-}
-
-async function announceLeaksOrThrow(
-  result: AuditResult,
-  report: Awaited<ReturnType<typeof reportHarm>>,
-): Promise<void> {
-  // `leakIds` includes credentials this scan encountered before. A scheduled
-  // run is a fresh safety check, so it must raise a fresh system notification
-  // when the leak is still present; the old per-finding marker is why only the
-  // first test run ever produced a banner. Older cached results fall back to
-  // first-seen ids.
-  const ids = result.leakIds ?? result.newLeakIds ?? [];
-  if (ids.length === 0) return;
-  // Read at fire time, not at scan time: the switch answers "should this
-  // interrupt me", and it is the user's most recent answer that counts.
-  if (!readConfig().audit.notify) return;
-
-  const n = ids.length === 1 ? "a possible credential exposure" : `${ids.length} possible credential exposures`;
-  // Fixed text with no scanned content and no count. A finding's own text comes
-  // from a repository this machine cloned, and notification bodies render
-  // markup on several Linux desktops. The count is intentionally left to the
-  // report too: a banner must not turn detector candidates into a claim that
-  // the user leaked N real credentials.
-  //
-  // No action buttons, deliberately. `Notify` supports them, but a server
-  // delivers the click back as an `ActionInvoked` signal to the sender — and
-  // this process exits as soon as the scan finishes, so the button would be
-  // dead. A plain command the user can copy beats a button that does nothing.
-  const emailState: DesktopLeakEmailState =
-    report.kind === "sent"
-      ? "sent"
-      : report.kind === "signed-out" || !readAuth()
-        ? "missing"
-        : report.kind === "failed"
-          ? "failed"
-          : "held";
-  const { title, body } = desktopLeakNotice(emailState);
-
-  // The two platforms need opposite things, and the split is not cosmetic. On
-  // Linux this process can reach the session bus itself. On macOS it cannot
-  // reach Notification Center at all — it is a child of a LaunchDaemon, outside
-  // the GUI session — so it hands the message to an agent that lives inside
-  // one. See `macos-notifier.ts` for why that agent exists.
-  if (process.platform === "darwin") {
-    pruneMacNotifyQueue();
-    if (!queueMacNotification(ids[0], title, body)) {
-      process.stderr.write(`failproofai: found ${n} but could not queue a notification\n`);
-    } else if (!macNotifierInstalled()) {
-      // Queued, but nothing currently collects it. The payload is durable and
-      // will be consumed when the LaunchAgent returns.
-      // Worth a line, because the immediate symptom is otherwise silence.
-      process.stderr.write(
-        `failproofai: found ${n}; the notifier is not installed, so nothing will show it ` +
-          `(run \`failproofai config\`)\n`,
-      );
-    }
-    return;
-  }
-
-  const outcome = await notifyDesktop(
-    title,
-    body,
-    // `0` asks the notification server for a fresh id. Each scheduled scan that
-    // still sees a leak is a new reminder, rather than replacing or suppressing
-    // the first banner forever.
-    0,
-  );
-  if (!outcome.ok) {
-    // stderr, so it lands in the journal beside the run it belongs to. Not a
-    // failure of the audit — but "we found a key and could not tell you" is
-    // exactly the sentence someone debugging this needs to find.
-    process.stderr.write(
-      `failproofai: found ${n} but could not raise a desktop notification (${outcome.reason})\n`,
-    );
-  }
-}
-
 // ── Headless (scheduled) audit ───────────────────────────────────────────────
 
 /**
@@ -541,9 +404,7 @@ export async function runScheduledAudit(): Promise<number> {
         `${num(result.transcripts.scanned)} sessions, ${num(result.totals.hits)} hits\n`,
     );
 
-    // Email is optional and never controls the local scan. Run it first only so
-    // the desktop notification can truthfully say whether this particular
-    // alert was also emailed; every failure remains a non-fatal outcome.
+    // Report harmful findings upstream, if the user switched emailed reports on.
     //
     // AFTER the dashboard cache is written and AFTER the success line, because
     // the scan is the product and this is an optional extra on top of it.
@@ -557,7 +418,6 @@ export async function runScheduledAudit(): Promise<number> {
     // would also make the manual command do a network call that
     // `audit --help` promises it does not.
     const outcome = await reportHarm(result);
-    await announceLeaksOnDesktop(result, outcome);
     const line = describeOutcome(outcome);
     if (line) {
       // Anything other than a successful send goes to stderr: on a scheduled run
@@ -692,16 +552,6 @@ export async function runAuditCli(args: string[]): Promise<void> {
     process.exit(0);
   }
 
-  for (const [flag, enable] of [["--notify", true], ["--no-notify", false]] as const) {
-    if (args.includes(flag)) {
-      const extra = args.find((a) => a !== flag);
-      if (extra) die(`\`audit ${flag}\` takes no other arguments (got: ${extra}).`);
-      const { runNotifyToggle } = await import("./schedule-cli");
-      runNotifyToggle(enable);
-      process.exit(0);
-    }
-  }
-
   if (args.includes("--no-schedule")) {
     const extra = args.find((a) => a !== "--no-schedule");
     if (extra) die(`\`audit --no-schedule\` takes no other arguments (got: ${extra}).`);