failproofai 1.0.4-beta.7 → 1.0.4

package/src/audit/desktop-notify.ts

@@ -1,420 +0,0 @@
-/**
- * A desktop notification on Linux, from a process with no desktop.
- *
- * The scheduled audit runs as a child of a SYSTEM-scope service. Its
- * environment was measured on a real machine and carries no
- * `DBUS_SESSION_BUS_ADDRESS`, no `DISPLAY`, no `WAYLAND_DISPLAY` and no
- * `XDG_RUNTIME_DIR` — the daemon starts at boot, before anyone logs in, which
- * is the whole reason it survives logout.
- *
- * That turns out not to be a permission problem. `/run/user/<uid>/bus` exists
- * whenever the user is logged in, the daemon already runs as that uid, and
- * D-Bus's EXTERNAL auth is `SO_PEERCRED` — the kernel vouches for the uid, so
- * there is no cookie, no session membership and no environment to inherit. The
- * address just has to be CONSTRUCTED rather than read. Proven on a real bus
- * with a fully scrubbed environment: `AUTH … OK` → accepted.
- *
- * ## Awaiting the reply is the entire correctness story
- *
- * Measured: a call sent with NO_REPLY_EXPECTED against a bus with no
- * notification server returns exit 0, empty stdout, empty stderr — the
- * notification silently evaporates. The same call awaiting its reply returns a
- * named error. Ship the fire-and-forget variant and you get exactly the failure
- * this feature exists to avoid: believing the user was told.
- *
- * With the reply awaited every failure is loud and fast (10-16ms measured):
- * logged out → ENOENT on connect, stale socket → ECONNREFUSED, no desktop →
- * `org.freedesktop.DBus.Error.ServiceUnknown`.
- *
- * One failure is NOT detectable from here and must not be papered over: on a
- * locked screen the shell still owns the name and still returns an id, while
- * the user sees nothing. `Notify` succeeding means the server accepted it,
- * never that a human saw it — which is why the queue, not the toast, is the
- * record of a finding.
- *
- * No dependency: the wire protocol is written by hand rather than pulling a
- * D-Bus client into a package that installs into other people's machines.
- */
-import { connect, type Socket } from "node:net";
-
-/** Milliseconds allowed for the whole exchange. Generous — a live bus answers
- *  in ~10ms, and this runs off the hook path entirely. */
-const TIMEOUT_MS = 2_000;
-
-export type NotifyOutcome =
-  | { ok: true; id: number }
-  | { ok: false; reason: "no-session" | "no-server" | "refused" | "timeout" | "error"; detail: string };
-
-/**
- * A D-Bus marshaller that knows where it is.
- *
- * Every alignment rule in the wire format is stated relative to the START OF
- * THE MESSAGE, which is why this tracks an offset instead of padding buffers in
- * isolation. The first version of this file did the latter — each helper padded
- * its own result to the boundary it needed — and it produced a header-fields
- * array two bytes too long, because the padding after the LAST element belongs
- * to the message rather than to the array. Real `dbus-daemon` dropped the
- * connection; the hand-written test server did not, because it mirrored the
- * same assumption the encoder made. The byte diff against a real client's
- * `Hello` is what settled it (0x70 vs 0x6e), and it is why the tests below now
- * run against a real bus.
- */
-class Marshal {
-  private chunks: Buffer[] = [];
-  private len = 0;
-
-  /** Pad to the next `n`-byte boundary, counted from the start of the message. */
-  align(n: number): void {
-    const pad = (n - (this.len % n)) % n;
-    if (pad) this.raw(Buffer.alloc(pad));
-  }
-  raw(b: Buffer): void {
-    this.chunks.push(b);
-    this.len += b.length;
-  }
-  byte(v: number): void {
-    this.raw(Buffer.from([v]));
-  }
-  u32(v: number): void {
-    this.align(4);
-    const b = Buffer.alloc(4);
-    b.writeUInt32LE(v, 0);
-    this.raw(b);
-  }
-  i32(v: number): void {
-    this.align(4);
-    const b = Buffer.alloc(4);
-    b.writeInt32LE(v, 0);
-    this.raw(b);
-  }
-  /** STRING / OBJECT_PATH: 4-aligned length, bytes, NUL. */
-  str(v: string): void {
-    const b = Buffer.from(v, "utf8");
-    this.u32(b.length);
-    this.raw(b);
-    this.byte(0);
-  }
-  /** SIGNATURE: a single length BYTE, bytes, NUL. No alignment. */
-  sig(v: string): void {
-    const b = Buffer.from(v, "utf8");
-    this.byte(b.length);
-    this.raw(b);
-    this.byte(0);
-  }
-  get length(): number {
-    return this.len;
-  }
-  buffer(): Buffer {
-    return Buffer.concat(this.chunks);
-  }
-}
-
-/** One header field: a STRUCT of (BYTE code, VARIANT value), 8-aligned. */
-type HeaderField = readonly [code: number, signature: string, value: string];
-
-/**
- * Encode the header-fields array.
- *
- * Returns the declared length SEPARATELY from the bytes, because they are not
- * the same number: the length stops at the end of the last element's content,
- * while the message then pads to 8 before the body. Conflating them is the bug
- * described on `Marshal`.
- */
-function headerFields(fields: readonly HeaderField[]): { data: Buffer; declaredLength: number } {
-  // The array's data starts at message offset 16, which is already 8-aligned,
-  // so offsets inside this marshaller line up with the real message.
-  const m = new Marshal();
-  for (const [code, signature, value] of fields) {
-    m.align(8); // each STRUCT element starts on an 8-byte boundary
-    m.byte(code);
-    m.sig(signature);
-    // Every header field we send is a string-like: OBJECT_PATH, STRING or
-    // SIGNATURE. Nothing here needs a numeric variant.
-    if (signature === "g") m.sig(value);
-    else m.str(value);
-  }
-  // No trailing padding was added, so the buffer length IS the declared length.
-  return { data: m.buffer(), declaredLength: m.length };
-}
-
-/** A METHOD_CALL: fixed header, header fields, 8-byte pad, then the body. */
-function methodCall(serial: number, fields: readonly HeaderField[], body: Buffer): Buffer {
-  const { data, declaredLength } = headerFields(fields);
-  const head = new Marshal();
-  head.raw(Buffer.from([0x6c, 1, 0, 1])); // little-endian, METHOD_CALL, no flags, proto 1
-  head.u32(body.length);
-  head.u32(serial);
-  head.u32(declaredLength);
-  head.raw(data);
-  head.align(8); // the body always starts on an 8-byte boundary
-  return Buffer.concat([head.buffer(), body]);
-}
-
-/**
- * The arguments of `org.freedesktop.Notifications.Notify`.
- *
- * Signature `susssasa{sv}i`: app_name, replaces_id, app_icon, summary, body,
- * actions, hints, expire_timeout.
- */
-function notifyBody(app: string, replacesId: number, summary: string, body: string): Buffer {
-  const m = new Marshal();
-  m.str(app);
-  m.u32(replacesId);
-  m.str("");        // app_icon — none; the app name is what identifies us
-  m.str(summary);
-  m.str(body);
-  m.u32(0);         // actions: `as`, empty. Element alignment 4, already met.
-  m.u32(0);         // hints: `a{sv}`, empty...
-  m.align(8);       // ...and an array pads to its ELEMENT alignment even when
-                    // empty. DICT_ENTRY is 8, so this padding is required and
-                    // counts toward the body length.
-  m.i32(-1);        // expire_timeout: -1 lets the server decide
-  return m.buffer();
-}
-
-/** `org.freedesktop.DBus.Hello` — mandatory before any other method call. */
-const HELLO_FIELDS: readonly HeaderField[] = [
-  [1, "o", "/org/freedesktop/DBus"],
-  [6, "s", "org.freedesktop.DBus"],
-  [2, "s", "org.freedesktop.DBus"],
-  [3, "s", "Hello"],
-];
-
-const NOTIFY_FIELDS: readonly HeaderField[] = [
-  [1, "o", "/org/freedesktop/Notifications"],
-  [6, "s", "org.freedesktop.Notifications"],
-  [2, "s", "org.freedesktop.Notifications"],
-  [3, "s", "Notify"],
-  [8, "g", "susssasa{sv}i"],
-];
-
-/** A parsed inbound message: only what the state machine dispatches on. */
-interface Incoming {
-  type: number;
-  replySerial: number | null;
-  errorName: string | null;
-  bodyStart: number;
-  bodyLength: number;
-  total: number;
-}
-
-/**
- * Read one whole message out of `buf`, or null when it has not all arrived.
- *
- * A framed reader rather than "assume one message per chunk", because a real
- * bus does not oblige: it answers `Hello` with a METHOD_RETURN and then emits a
- * `NameAcquired` SIGNAL, and the two can land in one chunk or two. The earlier
- * version consumed whichever chunk came first and treated the NEXT one as its
- * reply — which, for a SIGNAL, is neither an error nor a return, so it reported
- * the notification as delivered with a garbage id.
- */
-function readMessage(buf: Buffer): Incoming | null {
-  if (buf.length < 16) return null;
-  const bodyLength = buf.readUInt32LE(4);
-  const fieldsLength = buf.readUInt32LE(12);
-  const bodyStart = 16 + fieldsLength + ((8 - (fieldsLength % 8)) % 8);
-  const total = bodyStart + bodyLength;
-  if (buf.length < total) return null;
-
-  let replySerial: number | null = null;
-  let errorName: string | null = null;
-  // Walk the header fields far enough to find REPLY_SERIAL (5) and ERROR_NAME
-  // (4). Anything unparseable stops the walk rather than throwing: a header we
-  // cannot read is a message we ignore, not a crash on the audit's exit path.
-  let i = 16;
-  const end = 16 + fieldsLength;
-  while (i < end) {
-    i += (8 - ((i - 16) % 8)) % 8; // struct alignment, relative to the array start
-    if (i + 4 > end) break;
-    const code = buf[i];
-    const sigLen = buf[i + 1];
-    const sig = buf.toString("latin1", i + 2, i + 2 + sigLen);
-    i += 2 + sigLen + 1;
-    if (sig === "u") {
-      i += (4 - ((i - 16) % 4)) % 4;
-      if (i + 4 > end) break;
-      if (code === 5) replySerial = buf.readUInt32LE(i);
-      i += 4;
-    } else if (sig === "s" || sig === "o") {
-      i += (4 - ((i - 16) % 4)) % 4;
-      if (i + 4 > end) break;
-      const len = buf.readUInt32LE(i);
-      if (i + 4 + len > end) break;
-      if (code === 4) errorName = buf.toString("utf8", i + 4, i + 4 + len);
-      i += 4 + len + 1;
-    } else if (sig === "g") {
-      const len = buf[i];
-      i += 1 + len + 1;
-    } else {
-      break; // a type we do not send and cannot size; stop rather than guess
-    }
-  }
-  return { type: buf[1], replySerial, errorName, bodyStart, bodyLength, total };
-}
-
-/**
- * Where this process's session bus lives.
- *
- * Two callers with opposite environments, one rule. A human running
- * `failproofai audit` in their terminal HAS `DBUS_SESSION_BUS_ADDRESS`, and on
- * an unusual setup it is the only correct answer — so it wins when it is there
- * and names a socket we can open. The scheduled audit, a child of a system
- * service started before login, has nothing: for it the address is CONSTRUCTED
- * from the uid, which works because D-Bus EXTERNAL auth is `SO_PEERCRED` and
- * the kernel supplies the identity the environment could not.
- *
- * Only the `unix:path=` form is honored. The spec allows `unix:abstract=`,
- * `tcp:` and semicolon-separated alternatives; a bus we cannot dial is better
- * reported as "no session" than dialed wrong, and the fallback below already
- * covers every desktop that ships systemd.
- */
-export function resolveBusPath(env: Readonly<Record<string, string | undefined>>): string | null {
-  const declared = env.DBUS_SESSION_BUS_ADDRESS;
-  if (declared) {
-    for (const part of declared.split(";")) {
-      const m = /^unix:(?:.*,)?path=([^,]+)/.exec(part.trim());
-      if (m) return m[1];
-    }
-  }
-  const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  return uid >= 0 ? `/run/user/${uid}/bus` : null;
-}
-
-/**
- * Post a notification, awaiting the reply.
- *
- * `replacesId` reuses an earlier notification's id so repeated scans update one
- * bubble instead of stacking a fresh alert every time — the difference between
- * a reminder and a nag.
- */
-export function notifyDesktop(
-  summary: string,
-  body: string,
-  replacesId = 0,
-  opts: { socketPath?: string } = {},
-): Promise<NotifyOutcome> {
-  return new Promise((resolvePromise) => {
-    if (process.platform !== "linux" && !opts.socketPath) {
-      resolvePromise({ ok: false, reason: "error", detail: "linux only" });
-      return;
-    }
-    const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-    const path = opts.socketPath ?? resolveBusPath(process.env as Record<string, string | undefined>);
-    if (!path || uid < 0) {
-      resolvePromise({ ok: false, reason: "no-session", detail: "no bus address" });
-      return;
-    }
-
-    let settled = false;
-    const done = (o: NotifyOutcome) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      try { sock.destroy(); } catch { /* already gone */ }
-      resolvePromise(o);
-    };
-    const timer = setTimeout(() => done({ ok: false, reason: "timeout", detail: `${TIMEOUT_MS}ms` }), TIMEOUT_MS);
-
-    let sock: Socket;
-    try {
-      sock = connect(path);
-    } catch (err) {
-      done({ ok: false, reason: "no-session", detail: String(err) });
-      return;
-    }
-
-    let stage: "auth" | "hello" | "notify" = "auth";
-    let buf = Buffer.alloc(0);
-
-    sock.on("error", (err: NodeJS.ErrnoException) => {
-      // ENOENT: nobody is logged in, so /run/user/<uid> does not exist.
-      // ECONNREFUSED: a stale socket left behind by a dead bus.
-      done({
-        ok: false,
-        reason: err.code === "ENOENT" || err.code === "ECONNREFUSED" ? "no-session" : "error",
-        detail: err.code ?? String(err),
-      });
-    });
-
-    // A bus that hangs up mid-exchange is the signature of a message it could
-    // not parse. Without this the socket simply goes quiet and the whole thing
-    // reports a 2-second timeout — which points at a slow desktop rather than
-    // at us, and is exactly how the header-length bug survived its first tests.
-    sock.on("close", () => {
-      done({ ok: false, reason: "refused", detail: `bus closed the connection during ${stage}` });
-    });
-
-    sock.on("connect", () => {
-      // SASL EXTERNAL: the kernel already told the bus our uid over SO_PEERCRED,
-      // so the "credential" is just that uid in hex and no secret is exchanged.
-      const hexUid = Buffer.from(String(uid), "utf8").toString("hex");
-      sock.write(Buffer.concat([Buffer.from([0]), Buffer.from(`AUTH EXTERNAL ${hexUid}\r\n`, "utf8")]));
-    });
-
-    sock.on("data", (chunk: Buffer) => {
-      buf = Buffer.concat([buf, chunk]);
-
-      if (stage === "auth") {
-        const text = buf.toString("latin1");
-        const nl = text.indexOf("\r\n");
-        if (nl === -1) return;
-        if (!text.startsWith("OK")) {
-          done({ ok: false, reason: "refused", detail: text.slice(0, nl).trim().slice(0, 80) });
-          return;
-        }
-        // Anything after the OK line is already binary protocol — keep it.
-        buf = buf.subarray(nl + 2);
-        stage = "hello";
-        sock.write(Buffer.from("BEGIN\r\n", "utf8"));
-        sock.write(methodCall(1, HELLO_FIELDS, Buffer.alloc(0)));
-        // Fall through: the reply may already be in `buf`.
-      }
-
-      // Consume whole messages only. The bus answers Hello and then emits a
-      // NameAcquired SIGNAL; both can arrive in one chunk, and neither is
-      // guaranteed to arrive whole.
-      for (;;) {
-        const msg = readMessage(buf);
-        if (!msg) return;
-        const frame = buf.subarray(0, msg.total);
-        buf = buf.subarray(msg.total);
-
-        // 1 = METHOD_CALL, 2 = METHOD_RETURN, 3 = ERROR, 4 = SIGNAL.
-        if (msg.type === 4 || msg.type === 1) continue; // NameAcquired and friends
-
-        if (stage === "hello") {
-          if (msg.type === 3) {
-            done({ ok: false, reason: "refused", detail: msg.errorName ?? "Hello failed" });
-            return;
-          }
-          if (msg.replySerial !== 1) continue;
-          stage = "notify";
-          sock.write(methodCall(2, NOTIFY_FIELDS, notifyBody("failproofai", replacesId, summary, body)));
-          continue;
-        }
-
-        // Only OUR call's reply settles this. Matching on serial rather than on
-        // "the next message" is what keeps an unrelated signal from being read
-        // as a successful delivery.
-        if (msg.replySerial !== 2) continue;
-
-        if (msg.type === 3) {
-          const name = msg.errorName ?? "";
-          // The common one: logged in, but nothing is drawing notifications.
-          const noServer = name.includes("ServiceUnknown") || name.includes("NameHasNoOwner");
-          done({ ok: false, reason: noServer ? "no-server" : "error", detail: name || "error" });
-          return;
-        }
-
-        // METHOD_RETURN. The body is a single UINT32 id — read it back so a
-        // future call could replace this bubble rather than stack a new one.
-        const id =
-          msg.bodyLength >= 4 && frame.length >= msg.bodyStart + 4
-            ? frame.readUInt32LE(msg.bodyStart)
-            : 0;
-        done({ ok: true, id });
-        return;
-      }
-    });
-  });
-}

package/src/audit/leak-fingerprint.ts

@@ -1,198 +0,0 @@
-/**
- * How a leaked credential is NAMED once it leaves the machine.
- *
- * Every other redactor in this codebase exists to destroy a value. This one
- * exists to describe one, because the leak report has the opposite job: a
- * finding the reader cannot tie to a row in a vendor console is a finding they
- * cannot act on. `[REDACTED: GitHub token]` tells you nothing you can revoke.
- *
- * The rule is: **enough to identify, never enough to use.**
- *
- * ## Why the mask character matters, which is not obvious
- *
- * The three most natural masking characters — `X`, `x` and `0` — RE-MATCH every
- * vendor prefix pattern we ship. `AKIA` + sixteen `X`s satisfies
- * `AKIA[A-Z0-9]{16}`, so a masked AWS key is reported by failproofai as a live
- * AWS key on the next scan. The same holds for a masked connection string,
- * whose pattern keys on `://…@` and does not care what sits between. So the
- * mask is `•` (U+2022), which is in no credential charset anywhere, and the
- * unit tests assert that every masked form fails to re-match.
- *
- * That is not a hypothetical: this product measured its own audit output
- * feeding back into its own corpus, one leaked credential becoming seven
- * reported findings across four sessions.
- *
- * ## Why the last four, and why not always
- *
- * Last-4 is what vendor consoles display next to a key, so it is the token that
- * lets a human find the right row and press revoke. But it is only safe when
- * what remains is genuinely unguessable. For a 40-character GitHub token,
- * showing `ghp_` and four trailing characters leaves ~32 unknown base62
- * characters — no help to anyone. For a 13-character human-chosen password,
- * last-4 is nearly a third of the secret, and the corpus's one confirmed-live
- * password was exactly 13 characters at 3.19 bits per character.
- *
- * So the tail is shown only when the value clears BOTH bars: a recognised
- * public vendor prefix (which proves it is a minted token, not a typed
- * password) AND enough residual length. Everything else is described by class
- * and length alone.
- */
-
-/** The mask glyph. Never `X`, `x` or `0` — see the module header. */
-const MASK_CHAR = "•";
-
-/** Longest run of mask glyphs rendered, so a 200-char token stays readable. */
-const MAX_MASK_RUN = 8;
-
-/**
- * Minimum total length before any trailing characters are shown.
- *
- * 24 is chosen so that even the shortest minted token we recognise keeps well
- * over 100 bits of residual entropy after the prefix and tail are removed.
- * Human-chosen passwords essentially never reach it, which is the point.
- */
-const MIN_LEN_FOR_TAIL = 24;
-
-/** How many trailing characters a vendor console typically shows. */
-const TAIL_CHARS = 4;
-
-/**
- * Public, minted prefixes — the part of a credential that carries no secret.
- *
- * Each of these is published by its issuer and identical across every key they
- * mint, so showing it discloses nothing while telling the reader which console
- * to open. Ordered longest-first, so `sk-ant-api03-` wins over `sk-ant-` and
- * `sk-`; the first match is the one rendered.
- *
- * Deliberately NOT the full detection vocabulary. This list only has to be
- * right about what is safe to PRINT — a prefix missing from it costs a less
- * specific label, never a disclosure.
- */
-const PUBLIC_PREFIXES: ReadonlyArray<readonly [string, string]> = [
-  ["sk-ant-api03-", "Anthropic API key"],
-  ["sk-ant-oat01-", "Anthropic OAuth token"],
-  ["sk-ant-", "Anthropic key"],
-  ["sk-proj-", "OpenAI project key"],
-  ["sk-svcacct-", "OpenAI service-account key"],
-  ["sk-admin-", "OpenAI admin key"],
-  ["sk-or-v1-", "OpenRouter key"],
-  ["github_pat_", "GitHub fine-grained token"],
-  ["ghp_", "GitHub personal access token"],
-  ["gho_", "GitHub OAuth token"],
-  ["ghu_", "GitHub user-to-server token"],
-  ["ghs_", "GitHub server-to-server token"],
-  ["ghr_", "GitHub refresh token"],
-  ["glpat-", "GitLab personal access token"],
-  ["xoxb-", "Slack bot token"],
-  ["xoxp-", "Slack user token"],
-  ["xapp-", "Slack app-level token"],
-  ["sk_live_", "Stripe live secret key"],
-  ["sk_test_", "Stripe test secret key"],
-  ["rk_live_", "Stripe restricted key"],
-  ["AKIA", "AWS access key ID"],
-  ["ASIA", "AWS temporary access key ID"],
-  ["AIza", "Google API key"],
-  ["hf_", "Hugging Face token"],
-  ["gsk_", "Groq API key"],
-  ["r8_", "Replicate token"],
-  ["xai-", "xAI key"],
-  ["npm_", "npm access token"],
-  ["dop_v1_", "DigitalOcean token"],
-  ["shpat_", "Shopify access token"],
-  ["sbp_", "Supabase token"],
-];
-
-export interface LeakFingerprint {
-  /** What the reader sees: `ghp_••••••••4f2a` or `[13-char password]`. */
-  display: string;
-  /** Human label for the class, e.g. "GitHub personal access token". */
-  label: string;
-  /** Total character length of the original value. */
-  length: number;
-  /** True when a minted public prefix was recognised — i.e. we can name a
-   *  console to revoke at. False means "we know it leaked, not who issued it". */
-  attributed: boolean;
-}
-
-/** The recognised public prefix for a value, longest match first. */
-function matchPublicPrefix(value: string): readonly [string, string] | null {
-  for (const entry of PUBLIC_PREFIXES) {
-    if (value.startsWith(entry[0])) return entry;
-  }
-  return null;
-}
-
-/**
- * Render a credential as something a human can recognise and nobody can use.
- *
- * `fallbackLabel` names the class when no public prefix is recognised — pass
- * the detecting rule's own label (e.g. "assigned secret", "database password")
- * so an unattributed finding still says what KIND of thing leaked.
- */
-export function fingerprintSecret(value: string, fallbackLabel = "secret"): LeakFingerprint {
-  const length = value.length;
-  const matched = matchPublicPrefix(value);
-
-  if (!matched) {
-    // No minted prefix: this is a password, a first-party key, or a format we
-    // do not recognise. Nothing but the class and the length is safe to print,
-    // and the length is what lets the owner recognise their own value.
-    return {
-      display: `[${length}-char ${fallbackLabel}]`,
-      label: fallbackLabel,
-      length,
-      attributed: false,
-    };
-  }
-
-  const [prefix, label] = matched;
-  const bodyLength = length - prefix.length;
-  const run = MASK_CHAR.repeat(Math.max(1, Math.min(MAX_MASK_RUN, bodyLength)));
-
-  // The tail is the actionable half — but only when what stays hidden is
-  // genuinely unguessable. See the module header.
-  if (length >= MIN_LEN_FOR_TAIL && bodyLength > TAIL_CHARS * 2) {
-    return {
-      display: `${prefix}${run}${value.slice(-TAIL_CHARS)}`,
-      label,
-      length,
-      attributed: true,
-    };
-  }
-
-  return { display: `${prefix}${run}`, label, length, attributed: true };
-}
-
-/**
- * A stable identity for one distinct credential, for deduping across scans.
- *
- * Salted with a per-machine secret so the digest cannot be used as a lookup
- * oracle: without the salt, an attacker holding a guessable candidate (and the
- * corpus is full of dictionary passwords) could confirm it by comparing
- * hashes. With it, the id is meaningful only on the machine that produced it.
- *
- * The salt therefore forecloses cross-machine dedupe until an org-scoped key
- * exists — a deliberate trade recorded here so nobody reads a per-machine salt
- * as an oversight.
- */
-/**
- * Every id `fingerprintId` can produce, and nothing else.
- *
- * Ids become FILENAMES for pending macOS banners, so an id is a path component,
- * and a path component built from unvalidated input is a directory traversal.
- *
- * Ids are HMAC hex today, so nothing in a normal run can carry a `/`. That is
- * not the same as safe: the record is JSON read off disk, and `leaks.json` is a
- * file a user (or anything running as them) can edit. The guard is one regex
- * and it makes the property structural instead of incidental.
- */
-export function isFindingId(id: string): boolean {
-  return /^[0-9a-f]{16}$/.test(id);
-}
-
-export function fingerprintId(value: string, machineSalt: string): string {
-  // Lazily required so this module stays importable in the browser bundle,
-  // where the dashboard renders findings but never computes ids.
-  const { createHmac } = require("node:crypto") as typeof import("node:crypto");
-  return createHmac("sha256", machineSalt).update(value).digest("hex").slice(0, 16);
-}