failproofai 1.0.4-beta.8 → 1.0.4

package/src/audit/cli.ts

@@ -3,7 +3,7 @@
  * the dashboard to view it.
  *
  *   failproofai audit                Scan, then launch the dashboard at /audit.
- *   failproofai audit --schedule     Put local scans and notifications on a timer.
+ *   failproofai audit --schedule     Put scans on a timer and mail the findings.
  *   failproofai audit --no-schedule  Stop the timer.
  *   failproofai audit --status       What this machine is scheduled to do.
  *   failproofai audit -h, --help     Show usage.
@@ -35,11 +35,6 @@ import { getInstanceId } from "../../lib/telemetry-id";
 import { sanitizeErrorMessage } from "../../lib/telemetry-sanitize";
 import { openWhenReady } from "./open-browser";
 import { describeOutcome, reportHarm } from "./report-harm";
-import { notifyDesktop } from "./desktop-notify";
-import { macNotifierInstalled, pruneMacNotifyQueue, queueMacNotification } from "./macos-notifier";
-import { desktopLeakNotice, type DesktopLeakEmailState } from "../hooks/notice";
-import { readConfig } from "../hooks/fp-config";
-import { readAuth } from "../../lib/auth/auth-store";
 import { brandAnsi, ANSI_RESET, ANSI_BOLD, ANSI_DIM, helpScreen, helpOptsFor } from "../hooks/tui";
 import { version } from "../../package.json";
 
@@ -97,36 +92,26 @@ export function helpText(): string {
     {
       command: "audit",
       version,
-      tagline: "find credentials your agents leaked into their own transcripts",
+      tagline: "review your agent CLIs for risky and wasteful patterns",
       sections: [
         {
           label: "usage",
           entries: [
-            ["(bare)", `Scan your session history for leaked keys, then open http://localhost:${DASHBOARD_PORT}/audit`],
-            ["--schedule [days]", "Scan on a timer and notify you on this machine. Default 7 days, range 1-90. No account required."],
+            ["(bare)", `Scan your session history, then open http://localhost:${DASHBOARD_PORT}/audit`],
+            ["--schedule [days]", "Scan on a timer and email the findings. Default 7 days, range 1-90. Signs you in the first time."],
             // Its own row now, rather than a clause inside --schedule's. It
             // does not stand alone, which is why it used to be a clause — but
             // a clause wraps, and `--email <address>` landing with the flag at
             // the end of one line and its placeholder at the start of the next
             // is not a flag anybody can read or copy.
-            ["--email <address>", "With --schedule, add email alerts for the most recent masked credential leak. A sign-in code is emailed to you."],
+            ["--email <address>", "With --schedule, skips the sign-in prompt."],
             ["--no-schedule", "Stop the timer. Leaves you signed in."],
-            // Its own pair of flags rather than a clause on --schedule: whether
-            // this machine scans and whether it may interrupt you are separate
-            // decisions, and nobody silencing a banner should have to re-state
-            // their schedule to do it.
-            ["--notify", "Show a desktop notification when a scan finds a credential. On by default."],
-            ["--no-notify", "Stop desktop notifications. Scheduled scans and optional email alerts are unaffected."],
             ["--status", "Whether scheduling is on, where reports go, the daemon's state, and when the next scan is due."],
             ["-h, --help", "Show this help."],
           ],
         },
       ],
-      footer: [
-        "Every scan runs on this machine. Leak alerts appear as desktop system",
-        "notifications, never inside agent sessions. If you add email, only the",
-        "newest masked credential exposure and its metadata leave the machine.",
-      ],
+      footer: ["Everything runs on this machine; only a scheduled digest ever leaves it."],
     },
     helpOptsFor(process.stdout),
   );
@@ -214,18 +199,6 @@ function startProgress(): Progress {
     const lines = Array.from({ length: n }, (_, i) => lineFor(i));
     // Move the cursor back up over the previously-drawn block, then clear and
     // rewrite each line in place.
-    //
-    // INVARIANT: nothing else may write to the terminal while this is running.
-    // The cursor-up is a fixed count, so any stray line pushes the cursor down
-    // and the next redraw repaints the block lower — stranding the top of the
-    // old frame above it, which reads as the audit having run twice. That is
-    // not hypothetical: Node's "SQLite is an experimental feature" warning did
-    // exactly this on every first run, two lines of it, and it is why
-    // `lib/sqlite-reader.ts` now filters that one warning at the source.
-    //
-    // There is no defensive fix from inside here — erasing to end of screen
-    // still leaves the stranded lines ABOVE the cursor. Keep the terminal
-    // quiet instead.
     if (printed) process.stdout.write(`\x1b[${n}A`);
     process.stdout.write(lines.map((l) => `\x1b[2K${l}`).join("\n") + "\n");
     printed = true;
@@ -361,116 +334,6 @@ function heldByLine(held: AuditLockInfo | null): string {
   return `another audit is already running (pid ${held.pid}, started by ${held.source} ${ageS}s ago)`;
 }
 
-/**
- * Raise a desktop banner for credentials this scan found and nothing has
- * announced yet.
- *
- * Scheduled runs only, and the reason is the same one that keeps `reportHarm`
- * here: an interactive `failproofai audit` prints its findings to a person who
- * is already looking at them, so a banner on top is noise. The scheduled run is
- * the one with nobody watching, which is exactly when a notification is the
- * only thing that reaches anyone.
- *
- * Every failure is swallowed on purpose. This is an announcement about a
- * completed scan, not part of the scan: a machine with no desktop, a locked
- * session, a bus that hung — none of those make the audit itself a failure, and
- * turning a good scan into exit 1 would make the scheduler back off from
- * running the thing that actually matters.
- */
-async function announceLeaksOnDesktop(
-  result: AuditResult,
-  report: Awaited<ReturnType<typeof reportHarm>>,
-): Promise<void> {
-  try {
-    await announceLeaksOrThrow(result, report);
-  } catch (err) {
-    // The catch is not decoration. `notifyDesktop` documents that it never
-    // throws, but it is doing socket I/O, and so are the config read and the
-    // marker write beside it — depending on three modules' promises to keep a
-    // completed scan from reporting failure is a dependency this does not need
-    // to have.
-    process.stderr.write(
-      `failproofai: could not announce a leak on the desktop: ` +
-        `${err instanceof Error ? err.message : String(err)}\n`,
-    );
-  }
-}
-
-async function announceLeaksOrThrow(
-  result: AuditResult,
-  report: Awaited<ReturnType<typeof reportHarm>>,
-): Promise<void> {
-  // `leakIds` includes credentials this scan encountered before. A scheduled
-  // run is a fresh safety check, so it must raise a fresh system notification
-  // when the leak is still present; the old per-finding marker is why only the
-  // first test run ever produced a banner. Older cached results fall back to
-  // first-seen ids.
-  const ids = result.leakIds ?? result.newLeakIds ?? [];
-  if (ids.length === 0) return;
-  // Read at fire time, not at scan time: the switch answers "should this
-  // interrupt me", and it is the user's most recent answer that counts.
-  if (!readConfig().audit.notify) return;
-
-  const n = ids.length === 1 ? "a possible credential exposure" : `${ids.length} possible credential exposures`;
-  // Fixed text with no scanned content and no count. A finding's own text comes
-  // from a repository this machine cloned, and notification bodies render
-  // markup on several Linux desktops. The count is intentionally left to the
-  // report too: a banner must not turn detector candidates into a claim that
-  // the user leaked N real credentials.
-  //
-  // No action buttons, deliberately. `Notify` supports them, but a server
-  // delivers the click back as an `ActionInvoked` signal to the sender — and
-  // this process exits as soon as the scan finishes, so the button would be
-  // dead. A plain command the user can copy beats a button that does nothing.
-  const emailState: DesktopLeakEmailState =
-    report.kind === "sent"
-      ? "sent"
-      : report.kind === "signed-out" || !readAuth()
-        ? "missing"
-        : report.kind === "failed"
-          ? "failed"
-          : "held";
-  const { title, body } = desktopLeakNotice(emailState);
-
-  // The two platforms need opposite things, and the split is not cosmetic. On
-  // Linux this process can reach the session bus itself. On macOS it cannot
-  // reach Notification Center at all — it is a child of a LaunchDaemon, outside
-  // the GUI session — so it hands the message to an agent that lives inside
-  // one. See `macos-notifier.ts` for why that agent exists.
-  if (process.platform === "darwin") {
-    pruneMacNotifyQueue();
-    if (!queueMacNotification(ids[0], title, body)) {
-      process.stderr.write(`failproofai: found ${n} but could not queue a notification\n`);
-    } else if (!macNotifierInstalled()) {
-      // Queued, but nothing currently collects it. The payload is durable and
-      // will be consumed when the LaunchAgent returns.
-      // Worth a line, because the immediate symptom is otherwise silence.
-      process.stderr.write(
-        `failproofai: found ${n}; the notifier is not installed, so nothing will show it ` +
-          `(run \`failproofai config\`)\n`,
-      );
-    }
-    return;
-  }
-
-  const outcome = await notifyDesktop(
-    title,
-    body,
-    // `0` asks the notification server for a fresh id. Each scheduled scan that
-    // still sees a leak is a new reminder, rather than replacing or suppressing
-    // the first banner forever.
-    0,
-  );
-  if (!outcome.ok) {
-    // stderr, so it lands in the journal beside the run it belongs to. Not a
-    // failure of the audit — but "we found a key and could not tell you" is
-    // exactly the sentence someone debugging this needs to find.
-    process.stderr.write(
-      `failproofai: found ${n} but could not raise a desktop notification (${outcome.reason})\n`,
-    );
-  }
-}
-
 // ── Headless (scheduled) audit ───────────────────────────────────────────────
 
 /**
@@ -541,9 +404,7 @@ export async function runScheduledAudit(): Promise<number> {
         `${num(result.transcripts.scanned)} sessions, ${num(result.totals.hits)} hits\n`,
     );
 
-    // Email is optional and never controls the local scan. Run it first only so
-    // the desktop notification can truthfully say whether this particular
-    // alert was also emailed; every failure remains a non-fatal outcome.
+    // Report harmful findings upstream, if the user switched emailed reports on.
     //
     // AFTER the dashboard cache is written and AFTER the success line, because
     // the scan is the product and this is an optional extra on top of it.
@@ -557,7 +418,6 @@ export async function runScheduledAudit(): Promise<number> {
     // would also make the manual command do a network call that
     // `audit --help` promises it does not.
     const outcome = await reportHarm(result);
-    await announceLeaksOnDesktop(result, outcome);
     const line = describeOutcome(outcome);
     if (line) {
       // Anything other than a successful send goes to stderr: on a scheduled run
@@ -692,16 +552,6 @@ export async function runAuditCli(args: string[]): Promise<void> {
     process.exit(0);
   }
 
-  for (const [flag, enable] of [["--notify", true], ["--no-notify", false]] as const) {
-    if (args.includes(flag)) {
-      const extra = args.find((a) => a !== flag);
-      if (extra) die(`\`audit ${flag}\` takes no other arguments (got: ${extra}).`);
-      const { runNotifyToggle } = await import("./schedule-cli");
-      runNotifyToggle(enable);
-      process.exit(0);
-    }
-  }
-
   if (args.includes("--no-schedule")) {
     const extra = args.find((a) => a !== "--no-schedule");
     if (extra) die(`\`audit --no-schedule\` takes no other arguments (got: ${extra}).`);

package/src/audit/harm-report.ts

@@ -1,11 +1,10 @@
 /**
  * Turning an audit result into a harm report the api-server can act on.
  *
- * Runs only after a SCHEDULED scan (`failproofai audit --scheduled`) and only
- * ever from the audit child — never the daemon, which holds no human credential
- * precisely so that refresh rotation stays inside the audit lock. Without an
- * email identity the scan and desktop notification still work; this module
- * simply reports `signed-out` and sends nothing.
+ * Runs only after a SCHEDULED scan (`failproofai audit --scheduled`), only when
+ * the user has switched emailed reports on, and only ever from the audit child —
+ * never the daemon, which holds no human credential precisely so that refresh
+ * rotation stays inside the audit lock. See `crates/failproofaid/src/audit_lane.rs`.
  *
  * ## What counts as harm
  *
@@ -49,7 +48,6 @@
  */
 import type { AuditCount, AuditResult } from "./types";
 import { redactExample } from "./redact-example";
-import type { LeakFinding } from "./leak-record";
 
 /** Severities that mean "the engine would have stopped this". */
 const HARMFUL_SEVERITIES = new Set(["deny", "sanitize"]);
@@ -74,58 +72,10 @@ export interface ReportedPolicy {
   examples: string[];
 }
 
-/**
- * One leaked credential, as the digest carries it.
- *
- * **Nothing here can contain the secret**, and that is a structural property
- * rather than a promise this function keeps. `LeakFinding` has no field holding
- * the raw value — `recordLeaks` fingerprints at the moment of detection and
- * stores only the mask — so there is no raw value on disk for this to leak even
- * by accident. The most a bug here can send is a mask, a length and a label.
- *
- * The identifier NAME (`COMPOSIO_API_KEY`) is sent, and is not a secret: it is
- * the left-hand side of an assignment, and for the first-party class — 230 of
- * the 237 secret-named assignments the census measured, which no vendor console
- * can revoke — it is the only actionable thing in the finding. Without it the
- * digest can say a key leaked and not which one.
- */
-export interface ReportedLeak {
-  /** The machine-local salted id, so a reader can act on the same row twice.
-   *  An HMAC under a salt that never leaves the machine — it names the finding
-   *  without describing it. */
-  id: string;
-  /** WHAT. `ghp_••••••••4f2a`, or `[13-char password]` when nothing was minted. */
-  display: string;
-  label: string;
-  length: number;
-  /** False means "we know it leaked, not who issued it" — which changes the
-   *  advice from "revoke at this console" to "find where this came from". */
-  attributed: boolean;
-  /** The identifier it was assigned to, when there was one. */
-  name: string | null;
-  confidence: string;
-  first_seen: string;
-  last_seen: string;
-  occurrences: number;
-  /** WHO — the harness whose transcript carried it. */
-  cli: string;
-  /** WHERE — home-shortened already, like every path in `examples`. */
-  project: string;
-  /** HOW — "read from ~/…/.env". */
-  mechanism: string;
-  /** Input means the agent SENT it (deniable at PreToolUse next time); result
-   *  means the agent RECEIVED it, which no gate can undo. */
-  direction: "input" | "result";
-}
-
 export interface HarmReport {
   window_from?: string;
   window_to: string;
   harmful: ReportedPolicy[];
-  /** Credentials seen in this window. Separate from `harmful` because it is a
-   *  different kind of claim: `harmful` counts policy activity, this names a
-   *  specific object that needs rotating. */
-  leaks: ReportedLeak[];
 }
 
 /** `failproofai/block-rm-rf` → `block-rm-rf`. */
@@ -276,64 +226,10 @@ export function selectHarmful(
  * lower bound", so a policy carrying no usable timestamps is reported once on a
  * new machine rather than silently dropped by the bound this now always sets.
  */
-/**
- * The leaks worth putting in this window's digest.
- *
- * Windowed on `lastSeen`, not `firstSeen`: a key first seen months ago and used
- * again yesterday is live, and reporting it only in the window it debuted would
- * mean the digest goes quiet on exactly the credentials still in circulation.
- *
- * Dismissed findings never appear. A person who looked at a row and said "that
- * is not a secret" has given the only judgement available that beats ours, and
- * mailing it to them weekly afterwards is how a tool teaches people to filter
- * it out of their inbox.
- */
-export function selectLeaks(findings: LeakFinding[], from: Date, to: Date): ReportedLeak[] {
-  const lo = from.getTime();
-  const hi = to.getTime();
-  const out: ReportedLeak[] = [];
-  for (const f of findings) {
-    if (f.dismissedAt) continue;
-    const last = ts(f.lastSeen);
-    // No usable timestamp means it cannot be placed in a window. Included
-    // rather than dropped, for the same reason `includeUnplaceable` exists
-    // above: silence about a credential is the failure that costs something.
-    if (last !== null && (last < lo || last > hi)) continue;
-    // The most recent exposure is the one worth describing: it is where the key
-    // is now, not where it was first noticed.
-    // Defensive even though `readLeakRecord` already sanitises: this is
-    // exported and takes whatever a caller hands it.
-    const seen = f.sightings?.reduce((latest, candidate) => {
-      if (!latest) return candidate;
-      return (ts(candidate.at) ?? 0) >= (ts(latest.at) ?? 0) ? candidate : latest;
-    }, undefined as LeakFinding["sightings"][number] | undefined);
-    out.push({
-      id: f.id,
-      display: f.fingerprint?.display ?? "[credential]",
-      label: f.fingerprint?.label ?? "secret",
-      length: f.fingerprint?.length ?? 0,
-      attributed: f.fingerprint?.attributed === true,
-      name: f.name,
-      confidence: f.confidence,
-      first_seen: f.firstSeen,
-      last_seen: f.lastSeen,
-      occurrences: f.occurrences,
-      cli: seen?.cli ?? "unknown",
-      project: seen?.cwd ?? "unknown",
-      mechanism: seen?.mechanism?.summary ?? "seen in a transcript",
-      direction: seen?.mechanism?.direction ?? "result",
-    });
-  }
-  // Most recently seen first: the digest's first row should be the one whose
-  // key is most likely still in use.
-  return out.sort((a, b) => (ts(b.last_seen) ?? 0) - (ts(a.last_seen) ?? 0));
-}
-
 export function buildHarmReport(
   result: AuditResult,
   lastReportedAt: string | undefined,
   intervalDays: number,
-  leakFindings: LeakFinding[] = [],
 ): HarmReport {
   const to = new Date(Date.parse(result.scannedAt));
   const windowTo = Number.isFinite(to.getTime()) ? to : new Date();
@@ -360,8 +256,5 @@ export function buildHarmReport(
     window_from: from.toISOString(),
     window_to: windowTo.toISOString(),
     harmful: selectHarmful(result, from, windowTo, { includeUnplaceable: isFirstReport }),
-    // One email, one actionable credential. Sending every row turns a leak
-    // alert into a backlog digest and obscures the event that just happened.
-    leaks: selectLeaks(leakFindings, from, windowTo).slice(0, 1),
   };
 }