failproofai 1.0.4-beta.7 → 1.0.4

package/.next/standalone/.next/static/chunks/27du9n7ssja7l.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,86616,29054,e=>{"use strict";function t(e,a={},s=15e3){let n=AbortSignal.timeout(s),i=a.signal?AbortSignal.any([a.signal,n]):n;return fetch(e,{...a,signal:i})}function a(e){if(null===e||"object"!=typeof e)return!1;let t=e.name;return"AbortError"===t||"TimeoutError"===t}e.s(["fetchWithTimeout",0,t,"isAbortError",0,a],29054);class s extends Error{kind;constructor(e,t){super(t),this.kind=e,this.name="RerunError"}}async function n(e){try{let a=await t("/api/audit/run",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cli:e.cli.length>0?e.cli:void 0,since:"all"===e.since?void 0:e.since,noCache:!!e.noCache||void 0})});if(!a.ok&&409!==a.status){let e=await a.text().catch(()=>"");throw console.error("audit run failed:",a.status,e),new s("post_failed",`audit run failed (${a.status})`)}}catch(e){if(e instanceof s)throw e;throw console.error("audit run request failed:",e),new s(a(e)?"timeout":"network","audit run request failed")}let n=0;for(;;){await new Promise(e=>setTimeout(e,1e3));let e=null;try{let a=await t("/api/audit/status",{cache:"no-store"});a.ok&&(e=await a.json())}catch{}if(null===e){if(++n>=10)throw new s("network","audit status poll lost the server");continue}if(n=0,!e.running){if(e.error)throw new s("post_failed",e.error);return}}}e.s(["RerunError",0,s,"triggerRun",0,n],86616)},93237,e=>{"use strict";var t=e.i(43476),a=e.i(71645),s=e.i(95187);let n=(0,s.createServerReference)("0010d731e46f24bbaee74596f787e10879803125f1",s.callServer,void 0,s.findSourceMapURL,"getScheduledAuditAction"),i=(0,s.createServerReference)("4072a14fe91ce270d2518518491fa1971e194fedee",s.callServer,void 0,s.findSourceMapURL,"setAutoAuditAction"),l=(0,s.createServerReference)("403a11adb1c6381625711f1c9696b58c97cf602e2d",s.callServer,void 0,s.findSourceMapURL,"setAuditNotifyAction"),r=(0,s.createServerReference)("40cffc801944f1a09aa2865a3f3c380212656e17ec",s.callServer,void 0,s.findSourceMapURL,"setAuditIntervalAction");var o=e.i(86616),c=e.i(12344),d=e.i(29054);let u=/^[^\s@]+@[^\s@]+\.[^\s@]+$/;function h(e){if((0,d.isAbortError)(e))return"request timed out. check your network and try again.";let t=e instanceof Error?e.message:String(e);return`network error: ${t}`}function m({open:e,headline:s="where to route the reminder?",subhead:n="we'll send a one-time code to confirm.",onClose:i,onAuthed:l,source:r="unknown"}){let{capture:o}=(0,c.usePostHog)(),[f,b]=(0,a.useState)({kind:"email",error:null}),[p,y]=(0,a.useState)(!1),v=(0,a.useRef)(!1),x=(0,a.useRef)(null),w=(0,a.useRef)(null);(0,a.useEffect)(()=>{e&&(b({kind:"email",error:null}),y(!1),v.current=!1,o("audit_auth_dialog_opened",{source:r}))},[o,e,r]);let g=(0,a.useRef)(!1);(0,a.useEffect)(()=>{if(e){g.current=!0;return}g.current&&!v.current&&o("audit_auth_dialog_dismissed",{source:r,step:f.kind}),g.current=!1},[o,e,r,f.kind]),(0,a.useEffect)(()=>{if(!e)return;let t=setTimeout(()=>{"email"===f.kind?x.current?.focus():"code"===f.kind&&w.current?.focus()},50);return()=>clearTimeout(t)},[e,f.kind]),(0,a.useEffect)(()=>{if(!e)return;let t=e=>{"Escape"!==e.key||p||i()};return window.addEventListener("keydown",t),()=>window.removeEventListener("keydown",t)},[e,p,i]);let j="code"===f.kind&&f.resendIn>0;(0,a.useEffect)(()=>{if(!j)return;let e=setInterval(()=>{b(e=>"code"===e.kind?{...e,resendIn:Math.max(0,e.resendIn-1)}:e)},1e3);return()=>clearInterval(e)},[j]);let k=(0,a.useCallback)(async(e,t={})=>{let{isResend:a=!1}=t,s=e=>{a?b(t=>"code"===t.kind?{...t,error:e}:t):b({kind:"email",error:e})};y(!0);try{let t=await (0,d.fetchWithTimeout)("/api/auth/login-request",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({email:e})}),a=await t.json().catch(()=>({}));if(!t.ok){let e=a.message??"could not send code.";"rate_limited"===a.code&&void 0!==a.retry_after_secs?e=`too many tries. wait ${a.retry_after_secs}s and try again.`:"upstream_unreachable"===a.code&&(e="api-server unreachable. check your network."),s(e);return}b({kind:"code",email:e,error:null,expiresIn:a.expires_in??600,resendIn:a.resend_available_in??30})}catch(e){s(h(e))}finally{y(!1)}},[]),N=(0,a.useCallback)(async(e,t)=>{y(!0);try{let a=await (0,d.fetchWithTimeout)("/api/auth/login-verify",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({email:e,code:t})}),s=await a.json().catch(()=>({}));if(!a.ok||!s.authenticated||!s.user){let e=s.message??"invalid code.";"invalid_code"===s.code&&(e="wrong code, or it expired. try again."),b(t=>"code"===t.kind?{...t,error:e}:t);return}v.current=!0,o("audit_auth_dialog_succeeded",{source:r}),b({kind:"done",user:s.user}),l(s.user)}catch(t){let e=h(t);b(t=>"code"===t.kind?{...t,error:e}:t)}finally{y(!1)}},[o,l,r]),S=(0,a.useCallback)(async e=>{if(e.preventDefault(),p||"email"!==f.kind)return;let t=String(new FormData(e.currentTarget).get("email")??"").trim().toLowerCase();u.test(t)?await k(t):b({kind:"email",error:"that doesn't look like an email."})},[p,f,k]),C=(0,a.useCallback)(async e=>{if(e.preventDefault(),p||"code"!==f.kind)return;let t=String(new FormData(e.currentTarget).get("code")??"").trim();t.length<4||t.length>12?b(e=>"code"===e.kind?{...e,error:"code is 4–12 characters."}:e):await N(f.email,t)},[p,f,N]),M=(0,a.useCallback)(async()=>{"code"!==f.kind||f.resendIn>0||p||await k(f.email,{isResend:!0})},[f,p,k]);return e?(0,t.jsx)("div",{className:"auth-dialog-backdrop",role:"dialog","aria-modal":"true","aria-labelledby":"auth-dialog-title",onClick:e=>{p||e.target!==e.currentTarget||i()},children:(0,t.jsxs)("div",{className:"auth-dialog",children:[(0,t.jsx)("button",{type:"button",className:"auth-close",onClick:i,disabled:p,"aria-label":"close",children:"×"}),(0,t.jsx)("h2",{id:"auth-dialog-title",className:"auth-headline",children:s}),"email"===f.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("p",{className:"auth-sub",children:n}),(0,t.jsxs)("form",{onSubmit:S,className:"auth-form",children:[(0,t.jsx)("input",{ref:x,id:"auth-dialog-email",name:"email",type:"email",autoComplete:"email",inputMode:"email",spellCheck:!1,placeholder:"you@yourdomain.com",disabled:p,className:"auth-input",required:!0}),f.error&&(0,t.jsx)("div",{className:"auth-error",children:f.error}),(0,t.jsxs)("div",{className:"auth-actions",children:[(0,t.jsx)("button",{type:"submit",className:"auth-btn primary",disabled:p,children:p?"sending…":"send code"}),(0,t.jsx)("button",{type:"button",className:"auth-btn",onClick:i,disabled:p,children:"cancel"})]})]})]}),"code"===f.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("p",{className:"auth-sub",children:["code sent to ",(0,t.jsx)("span",{className:"auth-email",children:f.email}),". expires in ",Math.ceil(f.expiresIn/60)," min."]}),(0,t.jsxs)("form",{onSubmit:C,className:"auth-form",children:[(0,t.jsx)("input",{ref:w,id:"auth-dialog-code",name:"code",type:"text",inputMode:"numeric",autoComplete:"one-time-code",spellCheck:!1,placeholder:"123456",disabled:p,className:"auth-input auth-input-code",maxLength:12,required:!0}),f.error&&(0,t.jsx)("div",{className:"auth-error",children:f.error}),(0,t.jsxs)("div",{className:"auth-actions",children:[(0,t.jsx)("button",{type:"submit",className:"auth-btn primary",disabled:p,children:p?"verifying…":"verify"}),(0,t.jsx)("button",{type:"button",className:"auth-btn",onClick:M,disabled:p||f.resendIn>0,children:f.resendIn>0?`resend in ${f.resendIn}s`:"resend code"})]}),(0,t.jsx)("button",{type:"button",className:"auth-back",onClick:()=>b({kind:"email",error:null}),disabled:p,children:"← use a different email"})]})]}),"done"===f.kind&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("p",{className:"auth-sub",children:[(0,t.jsx)("span",{className:"auth-ok",children:"✓"})," signed in as"," ",(0,t.jsx)("span",{className:"auth-email",children:f.user.email}),"."]}),(0,t.jsx)("div",{className:"auth-actions",children:(0,t.jsx)("button",{type:"button",className:"auth-btn primary",onClick:i,children:"continue"})})]})]})}):null}var f=e.i(55574),b=e.i(34713);function p(e){return new Date(e).toLocaleString(void 0,{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit"})}function y(e,t){let a=e-t;if(a<=0)return"now";let s=Math.floor(a/864e5),n=Math.floor(a%864e5/36e5);return s>0?n>0?`${s}d ${n}h`:`${s}d`:n>0?`${n}h`:`${Math.max(1,Math.floor(a/6e4))}m`}function v(e){return e.toLocaleString("en-US")}function x({label:e,value:a,sub:s,tone:n}){return(0,t.jsxs)("div",{className:"set-stat",children:[(0,t.jsx)("div",{className:"set-stat-label",children:e}),(0,t.jsx)("div",{className:`set-stat-value${n?` ${n}`:""}`,children:a}),(0,t.jsx)("div",{className:"set-stat-sub",children:s??" "})]})}function w({lastRunAtMs:e,nextDueAtMs:a,now:s}){if(null==e||null==a||a<=e)return null;let n=Math.min(100,Math.max(0,(s-e)/(a-e)*100));return(0,t.jsxs)("div",{className:"tape","aria-hidden":"true",children:[(0,t.jsxs)("div",{className:"tape-rail",children:[(0,t.jsx)("div",{className:"tape-fill",style:{width:`${n}%`}}),(0,t.jsx)("div",{className:"tape-now",style:{left:`${n}%`}})]}),(0,t.jsxs)("div",{className:"tape-ends",children:[(0,t.jsxs)("span",{children:["last scan · ",p(e)]}),(0,t.jsxs)("span",{className:"tape-next",children:["next · ",y(a,s)]})]})]})}function g({enabled:e,onChange:a,disabled:s,label:n}){return(0,t.jsx)("button",{type:"button",role:"switch","aria-checked":e,"aria-label":n,disabled:s,onClick:a,className:"sw","data-on":e?"true":"false",children:(0,t.jsx)("span",{className:"sw-knob"})})}let j=[{label:"reads",body:"every session transcript on disk — your prompts, the files your agents read and wrote, and command output."},{label:"runs",body:"entirely on this machine. the transcripts never leave it."},{label:"sends",body:"only the newest masked credential exposure, its CLI, time, location, and this machine's name — only when email is configured."}];e.s(["default",0,function({initial:e}){let[s,c]=(0,a.useState)(e),[d,u]=(0,a.useState)(e?.auto??!1),[h,k]=(0,a.useState)(e?.notify??!0),[N,S]=(0,a.useState)(e?.intervalDays??7),[C,M]=(0,a.useState)(!1),[$,A]=(0,a.useState)(!1),[E,R]=(0,a.useState)(!1),[D,_]=(0,a.useState)(null===e),[T,I]=(0,a.useState)(0),L=(0,a.useRef)(!0),F=(0,a.useRef)(null!==e),O=(0,a.useCallback)(async()=>{try{let e=await n();if(!L.current)return;c(e),F.current=!0,u(e.auto),k(e.notify),S(e.intervalDays),I(Date.now()),_(!1)}catch{L.current&&!F.current&&_(!0)}},[]);(0,a.useEffect)(()=>(L.current=!0,O(),()=>{L.current=!1}),[O]),(0,a.useEffect)(()=>{let e=()=>void O();return window.addEventListener("focus",e),document.addEventListener("visibilitychange",e),()=>{window.removeEventListener("focus",e),document.removeEventListener("visibilitychange",e)}},[O]);let P=s?.signedInAs??null,U=s?.daemon==="running",q=s?.daemon==="unsupported-platform",B=s?.schedule??null,J=s?.lastScan??null,W=B?.lastExitCode!=null&&0!==B.lastExitCode&&75!==B.lastExitCode,K=(0,a.useCallback)(async()=>{M(!0);try{let e=await i(!0);u(e.auto),(0,f.toast)("scheduled audits on."),await O()}catch{u(!1),(0,f.toast)("could not turn that on.")}finally{M(!1)}},[O]),H=(0,a.useCallback)(async()=>{if(d){M(!0);try{let e=await i(!1);e.ok&&u(e.auto),(0,f.toast)("scheduled audits off."),await O()}catch{(0,f.toast)("could not turn that off.")}finally{M(!1)}return}await K()},[d,K,O]),z=(0,a.useCallback)(async()=>{let e=!h;M(!0);try{let t=await l(e);k(t.notify),c(e=>e?{...e,notify:t.notify}:e),(0,f.toast)(t.notify?"system notifications on.":"system notifications off.")}catch{(0,f.toast)(`could not turn system notifications ${e?"on":"off"}.`)}finally{M(!1)}},[h]),G=(0,a.useCallback)(async e=>{M(!0);try{let t=await r(e);S(t.intervalDays),c(e=>e?{...e,intervalDays:t.intervalDays}:e),(0,f.toast)(`scanning every ${t.intervalDays} day${1===t.intervalDays?"":"s"}.`)}catch{S(s?.intervalDays??7),(0,f.toast)("could not save that.")}finally{M(!1)}},[s?.intervalDays]),Q=(0,a.useCallback)(async()=>{M(!0);try{await fetch("/api/auth/logout",{method:"POST"}),(0,f.toast)("signed out. scans and desktop notifications continue; email alerts pause."),await O()}catch{(0,f.toast)("could not sign out.")}finally{M(!1)}},[O]),V=(0,a.useCallback)(async()=>{if(!$){A(!0);try{await (0,o.triggerRun)({cli:[],since:"all",noCache:!1}),(0,f.toast)("scan complete."),await O()}catch(e){(0,f.toast)(e instanceof o.RerunError&&"timeout"===e.kind?"the scan is taking a while — it will finish in the background.":"the scan could not be completed.")}finally{A(!1)}}},[O,$]),X=(0,a.useCallback)(async e=>{R(!1),await O(),await K()},[K,O]),Y=s?U?{value:"running",sub:null!=s.daemonStartedAtMs&&T>0?`up ${function(e){let t=Math.floor(e/864e5);if(t>0)return`${t}d`;let a=Math.floor(e/36e5);return a>0?`${a}h`:`${Math.max(1,Math.floor(e/6e4))}m`}(Math.max(0,T-s.daemonStartedAtMs))}`:"",tone:"ok"}:q?{value:"unavailable",sub:"not on this platform"}:"not-installed"===s.daemon?{value:"not installed",sub:"run failproofai config",tone:"warn"}:"unknown"===s.daemon?{value:"unknown",sub:"could not read it"}:{value:"stopped",sub:"run failproofai config",tone:"warn"}:{value:"…",sub:"reading"},Z=d?B?.nextDueAtMs==null?{value:"pending",sub:"after the next scan"}:{value:T>0?y(B.nextDueAtMs,T):"—",sub:p(B.nextDueAtMs)}:{value:"off",sub:"nothing scheduled"},ee=J?{value:(0,b.formatRelativeTime)(Date.parse(J.finishedAt)),sub:null!=J.sessionsScanned?`${v(J.sessionsScanned)} sessions`:"scanned"}:{value:"none yet",sub:"run one below"},et=J?null==J.findings?{value:"—",sub:"unreadable"}:{value:v(J.findings),sub:"this scan",...J.findings>0?{tone:"warn"}:{}}:{value:"—",sub:"no scan yet"};return(0,t.jsxs)("main",{className:"report",children:[(0,t.jsxs)("section",{className:"section set-sec",children:[(0,t.jsxs)("div",{className:"set-mast",children:[(0,t.jsx)("h1",{className:"set-title",children:"settings"}),(0,t.jsx)("p",{className:"set-lede",children:"keeping watch, so you don't have to."})]}),D?(0,t.jsx)("div",{className:"set-console",children:(0,t.jsx)("div",{className:"set-cell",children:(0,t.jsxs)("p",{className:"set-warn",children:["could not read this machine's settings. check that the dashboard can reach ",(0,t.jsx)("code",{children:"~/.failproofai/config.json"}),"."]})})}):(0,t.jsxs)("div",{className:"set-console",children:[(0,t.jsxs)("div",{className:"set-stats",children:[(0,t.jsx)(x,{label:"daemon",...Y}),(0,t.jsx)(x,{label:"next scan",...Z}),(0,t.jsx)(x,{label:"last scan",...ee}),(0,t.jsx)(x,{label:"findings",...et})]}),(0,t.jsxs)("div",{className:"set-cols",children:[(0,t.jsxs)("div",{className:"set-cell set-config",children:[(0,t.jsx)("h2",{className:"set-cell-title",children:"scheduled audit"}),(0,t.jsxs)("div",{className:"set-row set-row-main",children:[(0,t.jsx)(g,{enabled:d,disabled:C||null===s,onChange:()=>void H(),label:d?"turn off scheduled audits":"turn on scheduled audits"}),(0,t.jsxs)("div",{className:"set-row-copy",children:[(0,t.jsx)("span",{className:"set-strong",children:d?"scanning on a schedule.":"scan on a schedule."}),(0,t.jsx)("span",{className:"set-dim",children:d?P?"scheduled scans are active; the latest masked leak is emailed.":"scheduled scans are active. add an email below for masked alerts.":"off. nothing runs and nothing is sent."})]})]}),(0,t.jsxs)("div",{className:"set-row set-row-interval",children:[(0,t.jsx)("span",{className:"set-dim",children:"scan every"}),(0,t.jsx)("input",{type:"number",className:"set-num",min:1,max:90,value:N,disabled:C||null===s,"aria-label":"days between scheduled scans",onChange:e=>S(Number(e.target.value)),onBlur:e=>{let t=Number(e.target.value);Number.isFinite(t)?t!==s?.intervalDays&&G(t):S(s?.intervalDays??7)}}),(0,t.jsx)("span",{className:"set-dim",children:"days"}),(0,t.jsxs)("span",{className:"set-hint",children:[1,"–",90]})]}),(0,t.jsxs)("div",{className:"set-row set-row-main",children:[(0,t.jsx)(g,{enabled:h,disabled:C||null===s,onChange:()=>void z(),label:h?"turn off system notifications":"turn on system notifications"}),(0,t.jsxs)("div",{className:"set-row-copy",children:[(0,t.jsx)("span",{className:"set-strong",children:"system notifications."}),(0,t.jsx)("span",{className:"set-dim",children:h?"on when a scheduled scan finds credentials.":"off. scheduled scans and email alerts continue."})]})]}),(0,t.jsx)("div",{className:"set-rule"}),(0,t.jsx)("div",{className:"set-row set-row-identity",children:P?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("span",{className:"set-dim",children:"reports go to"}),(0,t.jsx)("span",{className:"set-email",children:P.email}),(0,t.jsx)("button",{type:"button",className:"set-link",disabled:C,onClick:()=>void Q(),children:"sign out"})]}):d?(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)("span",{className:"set-warn",children:"signed out — scheduled scans continue; email alerts are paused."}),(0,t.jsx)("button",{type:"button",className:"set-link",disabled:C,onClick:()=>R(!0),children:"add email alerts"})]}):(0,t.jsx)("span",{className:"set-dim",children:"scans and system notifications work without an account. add email later if you want alerts in your inbox."})}),d&&s&&!U&&(0,t.jsx)("p",{className:"set-warn",children:q?"the background service isn't available on this platform, so scheduled scans can't run here. you can still run one now.":"not-installed"===s.daemon?"the background service isn't installed, so nothing will run on the timer. install it with `failproofai config`.":"the background service is stopped, so nothing will run until it starts. repair it with `failproofai config`."}),W&&(0,t.jsxs)("p",{className:"set-warn",children:["the last scheduled scan exited ",B?.lastExitCode,". the next one will still run."]}),(0,t.jsx)("div",{className:"set-actions",children:(0,t.jsx)("button",{type:"button",className:"btn btn-press",disabled:$,onClick:()=>void V(),children:$?"[ scanning… ]":"[ run a scan now ]"})})]}),(0,t.jsxs)("div",{className:"set-cell set-how",children:[(0,t.jsx)("h2",{className:"set-cell-title",children:"how it works"}),(0,t.jsx)("dl",{className:"set-how-list",children:j.map(e=>(0,t.jsxs)("div",{className:"set-how-row",children:[(0,t.jsx)("dt",{className:"set-how-label",children:e.label}),(0,t.jsx)("dd",{className:"set-how-body",children:e.body})]},e.label))})]})]})]}),d&&T>0&&(0,t.jsx)(w,{lastRunAtMs:B?.lastRunAtMs??null,nextDueAtMs:B?.nextDueAtMs??null,now:T})]}),(0,t.jsx)(m,{open:E,source:"settings_scheduled_audit",headline:"where should the report go?",subhead:"we'll send a one-time code to confirm.",onClose:()=>R(!1),onAuthed:e=>void X(e)})]})}],93237)},34713,e=>{"use strict";e.s(["formatDuration",0,function(e){if(e<1e3)return`${e}ms`;let t=Math.round(e/100);if(t<600)return`${(t/10).toFixed(1)}s`;let a=Math.round(e/1e3);if(a<3600){let e=Math.floor(a/60);return`${e}m ${a%60}s`}let s=Math.round(e/6e4),n=Math.floor(s/60);return`${n}h ${s%60}m`},"formatRelativeTime",0,function(e){let t=Date.now()-e;return t<6e4?`${Math.max(1,Math.floor(t/1e3))}s ago`:t<36e5?`${Math.floor(t/6e4)}m ago`:t<864e5?`${Math.floor(t/36e5)}h ago`:`${Math.floor(t/864e5)}d ago`}])}]);

package/.next/standalone/.next/static/chunks/2h_pcb1y8_jde.js

@@ -1 +0,0 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,24358,e=>{"use strict";var s=e.i(43476),a=e.i(71645),n=e.i(95187);let t=(0,n.createServerReference)("0000e73cd773fa2c53602d9adf5b270fa497747e54",n.callServer,void 0,n.findSourceMapURL,"getAuditResultAction");var r=e.i(12344);function i({cachedAt:e,fixed:a=!1}){return(0,s.jsxs)("footer",{className:a?"report-footer report-footer--fixed":"report-footer",children:[(0,s.jsx)("img",{src:"/logo.svg",alt:"failproof_ai",style:{height:18,display:"inline-block",verticalAlign:"middle"}}),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"audit v1.0",(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),"generated ",function(e){if(!e)return"—";let s=new Date(e);if(Number.isNaN(s.getTime()))return"—";let a=s.getUTCDate().toString().padStart(2,"0"),n=["jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"][s.getUTCMonth()],t=s.getUTCFullYear(),r=s.getUTCHours().toString().padStart(2,"0"),i=s.getUTCMinutes().toString().padStart(2,"0");return`${a} ${n} ${t}, ${r}:${i} utc`}(e),(0,s.jsx)("span",{style:{margin:"0 12px",color:"var(--line-2)"},children:"·"}),(0,s.jsx)("span",{style:{color:"var(--ink-2)"},children:"auto-healing for your agents."})]})}let l=(0,n.createServerReference)("40b4a6c8d1e4b511e816c8d7493f24fb0e7e7be2e6",n.callServer,void 0,n.findSourceMapURL,"dismissLeakAction"),c=(0,n.createServerReference)("006f2aa64f86bf0154079fad166e1e5e06b1d050e5",n.callServer,void 0,n.findSourceMapURL,"getLeaksAction"),d=(0,n.createServerReference)("40a7972103d740f0429a2a6110f5ac4613c7847631",n.callServer,void 0,n.findSourceMapURL,"setLeakNotifyAction");function o(e){let s=Date.parse(e);if(!Number.isFinite(s))return"unknown";let a=Math.floor((Date.now()-s)/864e5);return a<=0?"today":1===a?"yesterday":a<30?`${a}d ago`:new Date(s).toLocaleDateString(void 0,{month:"short",day:"numeric"})}function u(){let[e,n]=(0,a.useState)(null),[t,r]=(0,a.useState)(!0),[i,u]=(0,a.useState)(null),h=(0,a.useCallback)(async()=>{let e=await c();n(e.rows),r(e.notify)},[]);(0,a.useEffect)(()=>{h()},[h]);let m=(0,a.useCallback)(async e=>{u(e);try{await l(e)&&n(s=>s?.filter(s=>s.id!==e)??null)}finally{u(null)}},[]),p=(0,a.useCallback)(async()=>{let e=!t;r(e),await d(e)||r(!e)},[t]);return null===e?null:(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"02 Leaks",children:[(0,s.jsxs)("div",{className:"audit-sec-head",children:[(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"02"}),"// credentials"]}),(0,s.jsx)("button",{type:"button",className:"cbb-toggle leak-notify","data-on":t,onClick:p,"aria-label":t?"turn desktop notifications off":"turn desktop notifications on",title:"desktop notification when a new credential is found",children:(0,s.jsx)("span",{className:"cbb-toggle-knob"})})]}),0===e.length?(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)("h2",{className:"audit-sec-title",children:"no credentials found"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// nothing in this machine's transcripts matched a known key format",(0,s.jsx)("br",{}),"// or a secret-named assignment."]})]}):(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)("h2",{className:"audit-sec-title",children:[e.length," credential",1===e.length?"":"s"," in your transcripts"]}),(0,s.jsx)("div",{className:"audit-sec-sub",children:"// one row per distinct key — an exposure count is not a key count."}),(0,s.jsx)("ul",{className:"leak-list",children:e.map(e=>(0,s.jsxs)("li",{className:"leak-row","data-attributed":e.attributed,children:[(0,s.jsxs)("div",{className:"leak-row-top",children:[(0,s.jsx)("code",{className:"leak-key",children:e.display}),(0,s.jsx)("span",{className:"leak-label",children:e.label}),e.name?(0,s.jsx)("span",{className:"leak-name",children:e.name}):null,(0,s.jsx)("button",{type:"button",className:"leak-dismiss",onClick:()=>void m(e.id),disabled:i===e.id,children:"not a secret"})]}),(0,s.jsxs)("div",{className:"leak-how",children:[(0,s.jsx)("span",{className:"leak-verb",children:e.mechanism})," in ",(0,s.jsx)("span",{className:"leak-where",children:e.project})," via ",(0,s.jsx)("span",{className:"leak-who",children:e.cli})," · leaked ",(0,s.jsx)("span",{className:"leak-when",children:o(e.firstSeen)}),e.firstSeen!==e.lastSeen?(0,s.jsxs)(s.Fragment,{children:[" · last seen ",(0,s.jsx)("span",{className:"leak-when",children:o(e.lastSeen)})]}):null]}),(0,s.jsxs)("div",{className:"leak-foot",children:[(0,s.jsxs)("span",{className:"leak-meta",children:[e.occurrences," exposure",1===e.occurrences?"":"s",e.sessions>1?` \xb7 ${e.sessions} sessions`:""," · ",e.length," chars"]}),(0,s.jsx)("span",{className:"leak-dir",children:"input"===e.direction?"sent by the agent — blockable at PreToolUse":"returned to the agent — already in the transcript"}),(0,s.jsx)("span",{className:"leak-fix",children:e.attributed?`rotate it in the ${e.label.replace(/ (API )?(key|token).*$/i,"")} console`:e.name?`find what reads ${e.name}, then rotate it there`:"trace it to its owner, then rotate it"})]})]},e.id))})]})]})}var h=e.i(86616);function m({mode:e,running:a,onStarted:n,onCompleted:t}){let{capture:i}=(0,r.usePostHog)(),l=async()=>{i("audit_first_run_clicked",{source:"empty_state",mode:e}),n();try{await (0,h.triggerRun)({cli:[],since:"all"})}catch(e){console.error("audit first run failed:",e)}finally{await t()}};return"no-cache"===e?(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," first run"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--dim)"},children:"○"})," no cache yet"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"scan and see."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let n=["1","5","8","10","13","17","20","23","25","30","32"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(n?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no audit data yet"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"run your first audit."}),(0,s.jsxs)("p",{className:"empty-sub",children:["we'll walk every transcript across your installed CLIs — Claude Code, Codex, Copilot, Cursor, OpenCode, Pi — and count every wasteful","or risky action. you'll get a leak report and a scan summary."]}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("button",{type:"button",className:"btn btn-primary btn-press empty-cta",onClick:l,disabled:a,children:a?"[ scanning… ]":"[ run audit ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"scans all sessions · all installed CLIs · may take a while"})]})]})]}):(0,s.jsxs)("section",{className:"section empty-section","data-screen-label":"00 Empty",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," zero transcripts"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--amber)"},children:"●"})," hooks not installed"]})]}),(0,s.jsx)("h2",{className:"section-h",children:"nothing to read."}),(0,s.jsxs)("div",{className:"panel empty-panel",children:[(0,s.jsxs)("div",{className:"empty-glyph","aria-hidden":"true",children:[(0,s.jsx)("div",{className:"empty-glyph-grid",children:Array.from({length:36}).map((e,a)=>{let n=["2","4","9","11","16","18","23","25","27","30","33"].includes(String(a));return(0,s.jsx)("span",{className:"px"+(n?" on":"")},a)})}),(0,s.jsx)("div",{className:"empty-glyph-label",children:"▮▮ no sessions found"})]}),(0,s.jsx)("h3",{className:"empty-headline",children:"install hooks first."}),(0,s.jsx)("p",{className:"empty-sub",children:"failproofai couldn't find any transcripts to scan on this machine. install the hooks for at least one CLI and come back."}),(0,s.jsxs)("div",{className:"empty-actions",children:[(0,s.jsx)("a",{href:"https://docs.befailproof.ai/getting-started",target:"_blank",rel:"noopener noreferrer",className:"btn btn-primary btn-press empty-cta",onClick:()=>{i("audit_install_guide_clicked",{source:"empty_state",mode:e})},children:"[ install guide → ]"}),(0,s.jsx)("span",{className:"empty-meta",children:"takes about 30 seconds · one command per CLI"})]})]})]})}let p=[{label:"discovering transcripts",detail:"walking ~/.claude, ~/.codex, ~/.cursor, …"},{label:"parsing session logs",detail:"reading JSONL + sqlite session stores"},{label:"running policy checks",detail:"replaying every policy against each tool call"},{label:"aggregating results",detail:"counting hits, ranking by frequency"}];function g(){let[e,n]=(0,a.useState)(0),[t,r]=(0,a.useState)(0);(0,a.useEffect)(()=>{let e=setInterval(()=>{n(e=>Math.min(e+1,p.length-1))},4e3),s=setInterval(()=>r(e=>(e+1)%4),350);return()=>{clearInterval(e),clearInterval(s)}},[]);let i=".".repeat(t+1),l=e===p.length-1,c=Math.round(100*Math.min(.9,(e+1)/p.length*.9));return(0,s.jsxs)("section",{className:"section running-section","data-screen-label":"00 Running",children:[(0,s.jsxs)("div",{className:"section-mast",children:[(0,s.jsxs)("div",{className:"section-label",children:[(0,s.jsx)("span",{className:"glyph",children:"━━"})," audit"," ",(0,s.jsx)("span",{className:"sep",children:"·"})," in progress"]}),(0,s.jsxs)("div",{className:"section-meta",children:[(0,s.jsx)("span",{style:{color:"var(--accent-pink)"},children:"●"})," scanning"]})]}),(0,s.jsxs)("h2",{className:"section-h",children:["scanning sessions",i]}),(0,s.jsxs)("div",{className:"panel running-panel",children:[(0,s.jsxs)("div",{className:"running-header",children:[(0,s.jsx)("span",{className:"running-prompt",children:"$"}),(0,s.jsx)("span",{className:"running-cmd",children:"failproofai audit"}),(0,s.jsx)("span",{className:"running-cursor","aria-hidden":"true",children:"▮"})]}),(0,s.jsx)("ul",{className:"running-stages",children:p.map((a,n)=>{let r=n<e,i=n===e;return(0,s.jsxs)("li",{className:"running-stage"+(r?" done":i?" active":" queued"),children:[(0,s.jsx)("span",{className:"running-marker","aria-hidden":"true",children:r?"✓":i?"▮▮":"○"}),(0,s.jsxs)("div",{className:"running-stage-body",children:[(0,s.jsx)("div",{className:"running-stage-label",children:a.label}),i&&(0,s.jsx)("div",{className:"running-stage-detail",children:l?"finishing up…":a.detail})]}),i&&(0,s.jsx)("span",{className:"running-stage-spin","aria-hidden":"true",children:["⠋","⠙","⠹","⠸"][t]})]},n)})}),(0,s.jsxs)("div",{className:"running-bar-label",children:[(0,s.jsx)("span",{children:"progress"}),(0,s.jsxs)("span",{style:{color:"var(--dim)"},children:[c,"%"]})]}),(0,s.jsx)("div",{className:"running-bar-track",children:(0,s.jsx)("div",{className:"running-bar-fill",style:{width:`${c}%`}})}),(0,s.jsx)("p",{className:"running-foot",children:"this can take a while depending on how much session history you have."})]})]})}let x={timeout:"audit took too long — try again",network:"network hiccup — check your connection",post_failed:"audit failed — try again"};function f({status:e,onDismiss:n}){let[t,r]=(0,a.useState)(()=>Date.now());if((0,a.useEffect)(()=>{if("running"!==e.kind)return;let s=setInterval(()=>r(Date.now()),1e3);return()=>clearInterval(s)},[e.kind]),"idle"===e.kind)return null;if("running"===e.kind){let a=Math.max(0,t-e.startedAt);return(0,s.jsxs)("div",{className:"audit-progress-strip",role:"status","aria-live":"polite",children:[(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__spinner","aria-hidden":"true"}),"re-auditing your sessions"]}),(0,s.jsx)("span",{className:"audit-progress-strip__elapsed",children:function(e){if(e<0)return"00:00";let s=Math.floor(e/1e3),a=Math.floor(s/60).toString().padStart(2,"0"),n=(s%60).toString().padStart(2,"0");return`${a}:${n}`}(a)})]}),(0,s.jsx)("div",{className:"audit-progress-strip__pulse","aria-hidden":"true"})]})}return(0,s.jsx)("div",{className:"audit-progress-strip audit-progress-strip--failed",role:"alert",children:(0,s.jsxs)("div",{className:"audit-progress-strip__inner",children:[(0,s.jsxs)("span",{className:"audit-progress-strip__label",children:[(0,s.jsx)("span",{className:"audit-progress-strip__x","aria-hidden":"true",children:"×"}),x[e.reason]]}),(0,s.jsx)("button",{type:"button",className:"audit-progress-strip__dismiss",onClick:n,"aria-label":"dismiss",children:"[ dismiss ]"})]})})}function j({result:e,cachedAt:n,projectFromUrl:t,isRunning:l,rerunStatus:c,onRerun:d,onDismissRerun:o}){let{capture:h}=(0,r.usePostHog)(),{detectorsTriggered:m,missing:p}=(0,a.useMemo)(()=>{let s=0,a=0;for(let n of e.results)n.hits>0&&s++,"builtin"===n.source&&!n.enabledInConfig&&n.hits>0&&a++;return{detectorsTriggered:s,missing:a}},[e]),g=(0,a.useRef)(!1);return(0,a.useEffect)(()=>{g.current||(g.current=!0,h("audit_dashboard_viewed",{missing:p,transcripts_scanned:e.transcripts.scanned,results_count:e.results.length,detectors_triggered:m}))},[h,p,e.transcripts.scanned,e.results.length,m]),(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(f,{status:c,onDismiss:o}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsxs)("div",{className:"report",children:[(0,s.jsx)(y,{transcripts:e.transcripts.scanned,events:e.eventsScanned??0,projects:e.projectsScanned?.length??0,isRunning:l||"running"===c.kind,onRerun:()=>d("scan_header")}),(0,s.jsx)(u,{})]}),(0,s.jsx)(i,{cachedAt:n})]})]})}function y({transcripts:e,events:a,projects:n,isRunning:t,onRerun:r}){return(0,s.jsxs)("section",{className:"audit-sec","data-screen-label":"01 Scan",children:[(0,s.jsxs)("div",{className:"audit-sec-head",children:[(0,s.jsxs)("span",{className:"audit-sec-eyebrow",children:[(0,s.jsx)("span",{className:"ix",children:"01"}),"// scan"]}),(0,s.jsx)("button",{type:"button",className:"scan-rerun",onClick:r,disabled:t,children:t?"scanning…":"run again"})]}),(0,s.jsx)("h2",{className:"audit-sec-title",children:"scan complete"}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:[a.toLocaleString()," tool call",1===a?"":"s"," across ",e.toLocaleString()," ","transcript",1===e?"":"s",n>0?` \xb7 ${n.toLocaleString()} project${1===n?"":"s"}`:""]}),(0,s.jsxs)("div",{className:"audit-sec-sub",children:["// the report is being rebuilt around leak detection. the scan, the",(0,s.jsx)("br",{}),"// 12-CLI transcript reader and the emailed digest are unaffected."]})]})}function N({running:e,mode:a="no-cache",rerunStatus:n,onDismissRerun:t,onStarted:r,onCompleted:l}){return(0,s.jsxs)("div",{className:"app",children:[(0,s.jsx)(f,{status:n,onDismiss:t}),(0,s.jsxs)("div",{className:"app-shell",children:[(0,s.jsx)("div",{className:"report",children:e?(0,s.jsx)(g,{}):(0,s.jsx)(m,{mode:a,running:e,onStarted:r,onCompleted:l})}),(0,s.jsx)(i,{cachedAt:null,fixed:!0})]})]})}e.s(["AuditDashboard",0,function({initial:e,projectFromUrl:n,totalCatalogSize:i}){let[l,c]=(0,a.useState)(e),[d,o]=(0,a.useState)(!1),[u,m]=(0,a.useState)({kind:"idle"}),{capture:p}=(0,r.usePostHog)(),g=(0,a.useRef)(null),x=(0,a.useRef)(!1),f="cached"===l.status?l.result.transcripts.scanned:0,y="cached"===l.status?l.result.results.length:0,b=(0,a.useCallback)(async()=>{c(await t())},[]),v=(0,a.useCallback)(async e=>{if(d)return;p("audit_rerun_clicked",{source:e,since:"all"}),o(!0);let s=Date.now();m({kind:"running",startedAt:s});try{await (0,h.triggerRun)({cli:[],since:"all",noCache:!0}),await b(),p("audit_rerun_succeeded",{source:e,since:"all",duration_ms:Date.now()-s}),m({kind:"idle"})}catch(n){let a=n instanceof h.RerunError?n.kind:"network";p("audit_rerun_failed",{kind:a,source:e,since:"all",cli_filter:"all",duration_ms:Date.now()-s}),m({kind:"failed",reason:a,failedAt:Date.now()})}finally{o(!1)}},[p,b,d]),k=(0,a.useCallback)(()=>{m({kind:"idle"})},[]);if((0,a.useEffect)(()=>(document.body.classList.add("audit-body"),()=>document.body.classList.remove("audit-body")),[]),(0,a.useEffect)(()=>{let e=d?"running":"empty"===l.status?"empty":0===f?"zero_sessions":"report";g.current!==e&&(g.current=e,p("audit_page_viewed",{state:e,has_cache:"cached"===l.status}))},[l.status,p,d,f]),(0,a.useEffect)(()=>{x.current=!1},[l.status,d,f]),(0,a.useEffect)(()=>{if(d||"cached"!==l.status||0===f)return;let e=0,s=()=>{if(e=0,x.current)return;let s=document.documentElement.scrollHeight-window.innerHeight;s<=0||window.scrollY>=s-24&&(x.current=!0,p("audit_page_scrolled_to_end",{results_count:y,transcripts_scanned:f}))},a=()=>{0===e&&(e=requestAnimationFrame(s))};return s(),window.addEventListener("scroll",a,{passive:!0}),()=>{window.removeEventListener("scroll",a),0!==e&&cancelAnimationFrame(e)}},[l.status,p,y,d,f]),"empty"===l.status&&!d)return(0,s.jsx)(N,{running:!1,rerunStatus:u,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await b()}});if("empty"===l.status&&d)return(0,s.jsx)(N,{running:!0,rerunStatus:u,onDismissRerun:k,onStarted:()=>{},onCompleted:async()=>{o(!1),await b()}});let w="cached"===l.status?l.result:null;if(!w)return null;let S="cached"===l.status?l.cachedAt:null;return 0===w.transcripts.scanned?(0,s.jsx)(N,{running:d,mode:"zero-sessions",rerunStatus:u,onDismissRerun:k,onStarted:()=>o(!0),onCompleted:async()=>{o(!1),await b()}}):(0,s.jsx)(j,{result:w,cachedAt:S,projectFromUrl:n,isRunning:d,rerunStatus:u,onRerun:e=>v(e),onDismissRerun:k})}],24358)},86616,29054,e=>{"use strict";function s(e,a={},n=15e3){let t=AbortSignal.timeout(n),r=a.signal?AbortSignal.any([a.signal,t]):t;return fetch(e,{...a,signal:r})}function a(e){if(null===e||"object"!=typeof e)return!1;let s=e.name;return"AbortError"===s||"TimeoutError"===s}e.s(["fetchWithTimeout",0,s,"isAbortError",0,a],29054);class n extends Error{kind;constructor(e,s){super(s),this.kind=e,this.name="RerunError"}}async function t(e){try{let a=await s("/api/audit/run",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cli:e.cli.length>0?e.cli:void 0,since:"all"===e.since?void 0:e.since,noCache:!!e.noCache||void 0})});if(!a.ok&&409!==a.status){let e=await a.text().catch(()=>"");throw console.error("audit run failed:",a.status,e),new n("post_failed",`audit run failed (${a.status})`)}}catch(e){if(e instanceof n)throw e;throw console.error("audit run request failed:",e),new n(a(e)?"timeout":"network","audit run request failed")}let t=0;for(;;){await new Promise(e=>setTimeout(e,1e3));let e=null;try{let a=await s("/api/audit/status",{cache:"no-store"});a.ok&&(e=await a.json())}catch{}if(null===e){if(++t>=10)throw new n("network","audit status poll lost the server");continue}if(t=0,!e.running){if(e.error)throw new n("post_failed",e.error);return}}}e.s(["RerunError",0,n,"triggerRun",0,t],86616)}]);

package/.next/standalone/app/actions/get-leaks.ts

@@ -1,104 +0,0 @@
-"use server";
-
-import {
-  activeFindings,
-  dismissFinding,
-  readLeakRecord,
-} from "@/src/audit/leak-store";
-import { readConfig, updateConfig } from "@/src/hooks/fp-config";
-
-/**
- * One credential, flattened for the report table.
- *
- * A separate shape from `LeakFinding` on purpose: this crosses into a client
- * component, so it carries only what is drawn. The finding's raw sightings, its
- * rule and its salt stay on the server side of the boundary — not because any
- * of them is a secret (the record holds no secret by construction), but because
- * a display type that mirrors the storage type drifts into rendering whatever
- * gets added to storage next.
- */
-export interface LeakRow {
-  id: string;
-  /** WHAT — `ghp_••••••••4f2a`. Never the value; there is no value to send. */
-  display: string;
-  label: string;
-  length: number;
-  /** False means no console to revoke at — the advice changes completely. */
-  attributed: boolean;
-  /** The identifier it was assigned to, when there was one. */
-  name: string | null;
-  /** WHO — the harness whose transcript carried it. */
-  cli: string;
-  /** WHERE — home-shortened project path. */
-  project: string;
-  /** WHEN — ISO, formatted client-side so it lands in the reader's timezone. */
-  lastSeen: string;
-  firstSeen: string;
-  /** HOW — "read from ~/…/.env". */
-  mechanism: string;
-  /** WHY IT MATTERS — an input the agent sent can be denied next time; a
-   *  result it received cannot be un-received. */
-  direction: "input" | "result";
-  occurrences: number;
-  sessions: number;
-}
-
-export interface LeaksPayload {
-  rows: LeakRow[];
-  /** Whether this machine may raise a desktop notification. Drawn as a toggle
-   *  beside the table, because the table is where somebody decides the banner
-   *  was worth it or not. */
-  notify: boolean;
-}
-
-export async function getLeaksAction(): Promise<LeaksPayload> {
-  const findings = activeFindings(readLeakRecord());
-  const rows: LeakRow[] = findings.map((f) => {
-    // The most recent sighting: where the key is now, not where it debuted.
-    const seen = f.sightings?.[f.sightings.length - 1];
-    return {
-      id: f.id,
-      display: f.fingerprint?.display ?? "[credential]",
-      label: f.fingerprint?.label ?? "secret",
-      length: f.fingerprint?.length ?? 0,
-      attributed: f.fingerprint?.attributed === true,
-      name: f.name,
-      cli: seen?.cli ?? "unknown",
-      project: seen?.cwd ?? "unknown",
-      lastSeen: f.lastSeen,
-      firstSeen: f.firstSeen,
-      mechanism: seen?.mechanism?.summary ?? "seen in a transcript",
-      direction: seen?.mechanism?.direction ?? "result",
-      occurrences: f.occurrences,
-      sessions: new Set((f.sightings ?? []).map((s) => s.sessionId)).size,
-    };
-  });
-  rows.sort((a, b) => Date.parse(b.lastSeen) - Date.parse(a.lastSeen));
-  return { rows, notify: readConfig().audit.notify };
-}
-
-/**
- * Mark one finding as not-a-secret.
- *
- * The finding is RETAINED, not deleted — deleting it would let the next scan
- * rediscover the same value and alert again, which is the one outcome that
- * teaches a user the dismiss button does not work.
- */
-export async function dismissLeakAction(id: string): Promise<boolean> {
-  return dismissFinding(id);
-}
-
-/**
- * Turn the desktop banner on or off.
- *
- * Writes the same `audit.notify` key `failproofai config` writes and the daemon's
- * audit child reads, so the dashboard and the CLI cannot disagree about it.
- */
-export async function setLeakNotifyAction(notify: boolean): Promise<boolean> {
-  try {
-    updateConfig({ audit: { notify } });
-    return true;
-  } catch {
-    return false;
-  }
-}

package/.next/standalone/app/audit/_components/leak-section.tsx

@@ -1,192 +0,0 @@
-"use client";
-
-/**
- * The leak report: every credential this machine found in its own transcripts.
- *
- * This is what replaced the persona poster and the five scored sections. The
- * old report answered "what kind of agent user are you"; this one answers the
- * only question a leaked key raises — what is it, where did it go, how did it
- * get there, and what do I do now.
- *
- * Each row is one DISTINCT credential, not one sighting: a key pasted into
- * forty commands is one thing to rotate, not forty. The count of exposures is a
- * column, which is the honest way to show forty without implying forty problems.
- */
-import { useCallback, useEffect, useState } from "react";
-import {
-  dismissLeakAction,
-  getLeaksAction,
-  setLeakNotifyAction,
-  type LeakRow,
-} from "@/app/actions/get-leaks";
-
-/** Rendered in the reader's timezone, which is why it is not done server-side. */
-function when(iso: string): string {
-  const t = Date.parse(iso);
-  if (!Number.isFinite(t)) return "unknown";
-  const days = Math.floor((Date.now() - t) / 86_400_000);
-  if (days <= 0) return "today";
-  if (days === 1) return "yesterday";
-  if (days < 30) return `${days}d ago`;
-  return new Date(t).toLocaleDateString(undefined, { month: "short", day: "numeric" });
-}
-
-/**
- * What to actually do about this one.
- *
- * Two genuinely different situations, and conflating them is what makes
- * security advice useless. A recognised prefix means a console exists and the
- * key can be revoked there in a minute. An unattributed value — the majority,
- * per the pattern census — has no console at all: the only move is to find
- * where it came from, and the identifier name is usually the only clue.
- */
-function advice(row: LeakRow): string {
-  if (row.attributed) return `rotate it in the ${row.label.replace(/ (API )?(key|token).*$/i, "")} console`;
-  if (row.name) return `find what reads ${row.name}, then rotate it there`;
-  return "trace it to its owner, then rotate it";
-}
-
-export function LeakSection() {
-  const [rows, setRows] = useState<LeakRow[] | null>(null);
-  const [notify, setNotify] = useState(true);
-  const [busy, setBusy] = useState<string | null>(null);
-
-  const load = useCallback(async () => {
-    const payload = await getLeaksAction();
-    setRows(payload.rows);
-    setNotify(payload.notify);
-  }, []);
-
-  useEffect(() => {
-    void load();
-  }, [load]);
-
-  const dismiss = useCallback(
-    async (id: string) => {
-      setBusy(id);
-      try {
-        // Optimism would be wrong here: a dismissal that did not persist means
-        // the row comes back on the next load, and the user has to guess which
-        // of the two states is real.
-        if (await dismissLeakAction(id)) setRows((prev) => prev?.filter((r) => r.id !== id) ?? null);
-      } finally {
-        setBusy(null);
-      }
-    },
-    [],
-  );
-
-  const toggleNotify = useCallback(async () => {
-    const next = !notify;
-    setNotify(next);
-    if (!(await setLeakNotifyAction(next))) setNotify(!next);
-  }, [notify]);
-
-  if (rows === null) return null;
-
-  return (
-    <section className="audit-sec" data-screen-label="02 Leaks">
-      <div className="audit-sec-head">
-        <span className="audit-sec-eyebrow">
-          <span className="ix">02</span>{"// credentials"}
-        </span>
-        <button
-          type="button"
-          className="cbb-toggle leak-notify"
-          data-on={notify}
-          onClick={toggleNotify}
-          aria-label={notify ? "turn desktop notifications off" : "turn desktop notifications on"}
-          title="desktop notification when a new credential is found"
-        >
-          <span className="cbb-toggle-knob" />
-        </button>
-      </div>
-
-      {rows.length === 0 ? (
-        <>
-          <h2 className="audit-sec-title">no credentials found</h2>
-          <div className="audit-sec-sub">
-            {"// nothing in this machine's transcripts matched a known key format"}
-            <br />
-            {"// or a secret-named assignment."}
-          </div>
-        </>
-      ) : (
-        <>
-          <h2 className="audit-sec-title">
-            {rows.length} credential{rows.length === 1 ? "" : "s"} in your transcripts
-          </h2>
-          <div className="audit-sec-sub">
-            {"// one row per distinct key — an exposure count is not a key count."}
-          </div>
-
-          <ul className="leak-list">
-            {rows.map((row) => (
-              <li key={row.id} className="leak-row" data-attributed={row.attributed}>
-                <div className="leak-row-top">
-                  <code className="leak-key">{row.display}</code>
-                  <span className="leak-label">{row.label}</span>
-                  {row.name ? <span className="leak-name">{row.name}</span> : null}
-                  <button
-                    type="button"
-                    className="leak-dismiss"
-                    onClick={() => void dismiss(row.id)}
-                    disabled={busy === row.id}
-                  >
-                    not a secret
-                  </button>
-                </div>
-
-                {/* The 5W1H, as one sentence rather than a grid of labelled
-                    cells — a person reading a leak wants the story, and the
-                    grid version made every row look like a form to fill in. */}
-                {/* The date is FIRST seen, not last. "When did this key get
-                    into a transcript" is the question a leak raises; "when did
-                    I last run a scan that noticed" is not. They also looked
-                    identical in practice — the record keeps the 500 most
-                    recently seen findings, so everything surviving the cap
-                    reported the same recent `lastSeen` and every row read
-                    "today", which is true and useless. */}
-                <div className="leak-how">
-                  <span className="leak-verb">{row.mechanism}</span>
-                  {" in "}
-                  <span className="leak-where">{row.project}</span>
-                  {" via "}
-                  <span className="leak-who">{row.cli}</span>
-                  {" · leaked "}
-                  <span className="leak-when">{when(row.firstSeen)}</span>
-                  {row.firstSeen !== row.lastSeen ? (
-                    <>
-                      {" · last seen "}
-                      <span className="leak-when">{when(row.lastSeen)}</span>
-                    </>
-                  ) : null}
-                </div>
-
-                <div className="leak-foot">
-                  <span className="leak-meta">
-                    {row.occurrences} exposure{row.occurrences === 1 ? "" : "s"}
-                    {row.sessions > 1 ? ` · ${row.sessions} sessions` : ""}
-                    {" · "}
-                    {row.length} chars
-                  </span>
-                  {/* The direction is the difference between a leak a gate can
-                      stop next time and one it cannot. An input travelled OUT
-                      of the machine with the agent's request; a result came
-                      back INTO the transcript from a file or a command, where
-                      no PreToolUse hook can intercept it. */}
-                  <span className="leak-dir">
-                    {row.direction === "input"
-                      ? "sent by the agent — blockable at PreToolUse"
-                      : "returned to the agent — already in the transcript"}
-                  </span>
-                  <span className="leak-fix">{advice(row)}</span>
-                </div>
-              </li>
-            ))}
-          </ul>
-        </>
-      )}
-    </section>
-  );
-}