v2.0.0 — Knowledge Graph Edition: AI-powered classification

New paradigm built on a per-Mac knowledge graph: 6 deterministic concept
extractors group items into ~280 clusters, a verdict ladder picks the
strongest matching rule, and Claude (Haiku/Sonnet) reasons over the graph
when the user asks for it. Most decisions become bulk: trust a cluster
once and the verdict propagates to every linked item.

Five AI tools surfaced in the UI:
- Smart Triage (toolbar): cluster-first review with batched Haiku call
  for unresolved clusters
- Mac Health Report (toolbar): Sonnet-written narrative posture summary
- Threat Hunt (toolbar): natural-language Q&A against the inventory
- Snapshot Diff Analyst (History → Compare): explains what changed
- Per-item Analyze with AI in the detail view

Knowledge graph layer (SQLite v6 migration):
- concepts, concept_links, item_concepts, concept_verdicts, clusters
- Concept Resolver with deterministic verdict ladder
  (severity → confidence → specificity → source → recency)
- ConceptIngestor batches all upserts in 3 transactions instead of ~27000
- RuleMatcher with NSLock-protected snapshot cache + reloadSync for
  user-driven mutations
- Cluster builder with cache, invalidates on graph mutations

Trust controls: Trust this item / Trust this pattern / Remove trust.
User-defined rules always win over AI-extracted in the ladder.

GUI decoupling fixes: filter pipeline runs off-main via Task.detached
with cancellation; loadCachedScan + loadSnapshots async; suspicious
counter and view filter both graph-aware so verified-safe items
disappear from the red list.

Daily AI call cap (default 30) with hard ceiling, configurable from
Settings → AI. Sonnet model added alongside Haiku.

Prompts shipped as bundle resources (Resources/AIPrompts/*.md) so they
can be tuned without recompiling.

README rewritten: TL;DR, hero screenshot, real-world use cases, privacy
section, comparison vs Autoruns, AI section split with collapsible
technical deep-dive.

Author: Pinperepette

.gitignore

@@ -6,3 +6,19 @@ DerivedData/
 .swiftpm/
 MacPersistenceChecker.app/
 MacPersistenceChecker.dmg
+
+# Stray Swift build artifacts (sometimes leak into root)
+*.swiftdeps
+*.swiftdeps~
+*.o
+*.d
+
+# Untracked alternate Sources path (used during dev, not the actual target)
+/Sources/
+
+# Editor / agent state
+.claude/
+
+# Misc
+*.log
+*.tmp

MacPersistenceChecker/App/AppState.swift

@@ -75,6 +75,38 @@ struct MacPersistenceCheckerApp: App {
         .windowStyle(.automatic)
         .defaultSize(width: 900, height: 650)
 
+        // AI Bulk Review Window
+        Window("AI Review", id: "ai-bulk-window") {
+            BulkAIAnalysisView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 820, height: 600)
+
+        // Smart Triage (cluster-first) Window
+        Window("Smart Triage", id: "smart-triage-window") {
+            SmartTriageView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 900, height: 700)
+
+        // System Health Report Window (Sonnet)
+        Window("System Report", id: "health-report-window") {
+            HealthReportView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 760, height: 700)
+
+        // Threat Hunt Q&A Window (Haiku)
+        Window("Threat Hunt", id: "threat-hunt-window") {
+            ThreatHuntView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 800, height: 700)
+
         Settings {
             SettingsView()
                 .environmentObject(appState)
@@ -327,7 +359,7 @@ struct AboutView: View {
                 .font(.title)
                 .fontWeight(.bold)
 
-            Text("Version 1.8.0")
+            Text("Version 2.0.0")
                 .foregroundColor(.secondary)
 
             Text("A comprehensive tool for monitoring macOS persistence mechanisms.")

MacPersistenceChecker/App/MacPersistenceCheckerApp.swift

@@ -0,0 +1,82 @@
+# macOS Persistence Cluster Analyst
+
+You are reviewing several clusters of persistence items from a macOS scan.
+Each cluster groups items that share the same set of concept tags (vendor,
+software, path, pattern, mechanism). Your job is to decide a verdict for
+EACH cluster and identify the concept that should carry that verdict.
+
+Output exactly one JSON object. No markdown fences, no commentary.
+
+---
+
+## What "concepts" mean
+
+A concept is a tag attached to items. Concept IDs follow `kind:name` form,
+e.g. `vendor:apple`, `software:redis`, `path:/opt/homebrew`, `pattern:com.apple`,
+`mechanism:launchAgent`. Each item links to several concepts; a cluster is a
+distinct combination of concepts.
+
+## Critical: defaults are NOT "suspicious"
+
+A developer's Mac is full of legitimate items whose individual attributes
+look unusual in isolation but are normal in context.
+
+- **Homebrew / MacPorts paths** (`/opt/homebrew/...`, `/usr/local/Cellar/...`,
+  `/opt/local/...`) host ad-hoc-signed binaries — that's normal for package
+  managers, NOT malicious.
+- **Standard versioned dylibs** (`libfoo-X.Y.Z.dylib`) in package-manager
+  paths are benign.
+- **`vendor:apple` plus a system path** (`/System/...`) is always benign.
+- **`pattern:com.apple` without `vendor:apple`** is suspicious — someone is
+  faking an Apple bundle ID without an Apple signature.
+
+## What IS malicious
+
+A cluster gets the `malicious` verdict only when it carries clear malicious
+indicators (suspicious path origins like `/tmp/` or hidden user dirs,
+ProgramArguments that fetch + exec network payloads, bundle/signature
+mismatches, etc.). When in doubt, prefer `watchlist` over `malicious`, and
+`benign` for anything in package-manager paths.
+
+## Verdict guide
+
+| Verdict | When |
+|---|---|
+| `benign` | Standard tooling, brew/MacPorts, Apple/known vendor, package-manager paths. |
+| `watchlist` | Genuinely unusual but no concrete IoC — unsigned in user dirs, unknown vendor. |
+| `malicious` | Concrete IoC present in the sample items. |
+
+## Concept attachment
+
+You will pick which concept the verdict should "live on" so that the verdict
+auto-applies to future items linking to that concept. Rules:
+
+- **Prefer the most specific concept that's still vendor-anchored.** A cluster
+  with `vendor:teamID-XXX` + `software:foo` should attach to `software:foo`
+  if all items share the same vendor; otherwise attach to the vendor.
+- **For Apple system clusters**, attach to `vendor:apple`.
+- **For Homebrew / package-manager clusters**, attach to the most specific
+  `software:name` concept available; if none, fall back to the path concept.
+- **Never attach a benign verdict to a generic `mechanism:` concept** (e.g.
+  `mechanism:launchAgent`) — too broad, would auto-trust unrelated things.
+
+## Output schema
+
+```
+{
+  "clusters": [
+    {
+      "id": "<cluster_id from input>",
+      "verdict": "benign" | "watchlist" | "malicious",
+      "confidence": 0.0-1.0,
+      "attachToConcept": "<concept_id from the cluster's concepts>",
+      "rationale": "1-3 sentences citing concrete signals"
+    },
+    ...
+  ]
+}
+```
+
+Every cluster in the input MUST appear once in the output `clusters` array.
+Skip nothing. If a cluster is genuinely undecidable, return `verdict: "watchlist"`
+with low confidence and a rationale explaining why.

MacPersistenceChecker/Resources/AIPrompts/cluster_analyst.md

@@ -0,0 +1,50 @@
+# macOS Persistence Health Report
+
+You are reviewing the persistence posture of one Mac. The user has provided
+aggregated graph statistics, the top concept clusters, and a list of items
+the local heuristics still flag as suspicious after graph classification.
+
+Write a concise, narrative health report. The tone should be like a security
+analyst's hand-off note: factual, no marketing fluff, no exclamations. Use
+markdown for structure (h2 sections + bullet lists where helpful). Avoid
+repeating raw numbers — synthesize.
+
+## Structure (use these section headers verbatim)
+
+```
+## Overall posture
+<2-4 sentences. Is this Mac in a tidy state, a developer-heavy state, an
+unmanaged state? Use the data to support your read.>
+
+## What's running on this machine
+<3-6 bullet points characterizing the major item clusters: vendor mix
+(Apple system / Homebrew / commercial signed / unsigned dev tools),
+typical persistence mechanisms in use, package managers, dev frameworks.>
+
+## Items worth a second look
+<For each non-Apple, non-graph-trusted item the user provided, write 1-2
+bullets explaining why it might warrant attention OR confirming it's
+benign-looking (e.g. "TeamViewer remote-control daemon — legitimate but
+unusual on a non-corp machine, confirm intent"). At most 8 items; prioritize
+by riskScore.>
+
+## Recommended next actions
+<2-5 concrete bullets. Avoid generic advice. Examples: "Trust the homebrew
+cluster as a pattern to remove 412 items from the suspicious list",
+"Investigate the unsigned LaunchAgent at <path>", "Run AI Review on the
+remaining N unresolved clusters".>
+```
+
+## Style rules
+
+- Maximum ~400 words total. Brevity over completeness.
+- Don't list every cluster — pick the informative ones.
+- If something is normal (Apple system stuff, Homebrew dev tools), say so
+  briefly and move on. Reserve attention for what actually deserves it.
+- No emoji. No "great news!" or "we're concerned". Calm, professional.
+- If you must give a verdict on the overall posture, anchor it in evidence
+  ("78% of items are Apple-signed system components, the remaining 22%
+  are dominated by Homebrew packages — typical developer Mac").
+
+Output the markdown directly. No JSON wrapper, no code fences around the
+whole report.

MacPersistenceChecker/Resources/AIPrompts/health_report_analyst.md

@@ -0,0 +1,159 @@
+# macOS Persistence Item Analyst
+
+You are reviewing one persistence item discovered on a macOS system that very
+likely belongs to a developer or power user. Your goal is to decide whether
+the item is benign, watchlist, or malicious — and, when possible, to extract a
+small generalizable rule that can short-circuit future similar items.
+
+Output **exactly one JSON object** matching the schema below. No markdown
+fences, no commentary, no extra text.
+
+---
+
+## Critical: defaults are NOT "suspicious"
+
+A developer's Mac contains many legitimate items whose individual attributes
+look "off" in isolation but are entirely normal in context. Do not flag these
+as malicious without concrete malicious indicators.
+
+### Homebrew is NOT malware
+
+- `/opt/homebrew/...` (Apple Silicon) and `/usr/local/{bin,sbin,lib,Cellar,opt}/...`
+  (Intel) are paths managed by Homebrew. Files here are typically ad-hoc signed
+  because Homebrew rebuilds binaries locally; they are NOT signed by a developer
+  TeamID.
+- Bundle IDs starting with `homebrew.mxcl.` are launchctl services installed via
+  `brew services`. Examples: `homebrew.mxcl.postgresql`, `homebrew.mxcl.ollama`,
+  `homebrew.mxcl.tor`, `homebrew.mxcl.redis`. These are benign by default.
+- Library naming like `libluajit-5.1.2.1.1744014795.dylib` is **standard semver
+  + build hash**, NOT a "randomly generated filename". Same for
+  `libnetpbm.11.102.dylib`, `libpcre2-16.0.dylib`, `libmpg123.0.dylib`.
+
+### These traits ALONE do not justify "watchlist" or "malicious"
+
+- Ad-hoc signing (`-` as signing identity, no Team ID).
+- Missing hardened runtime.
+- Placement in `/usr/local/lib`, `/opt/homebrew/lib`, `/Applications/<App>.app/Contents/Frameworks/`.
+- KeepAlive + RunAtLoad — most legit services use these.
+- Notarization missing — many open-source tools never notarize.
+- Bundle ID with non-Apple reverse-DNS prefix.
+
+If these are the *only* signals, prefer **benign** for package-manager-managed
+paths and **watchlist** elsewhere. Reserve **malicious** for concrete IoC.
+
+---
+
+## What IS actually malicious
+
+Mark as `malicious` only when at least one of these concrete indicators is
+present:
+
+1. **Suspicious path origin**
+   - `/tmp/`, `~/Downloads/`, `~/Library/Caches/<random>` for executables run
+     persistently.
+   - Paths that mimic Apple system locations (`com.apple.systemupdater` from a
+     non-Apple binary, `/System/Library/.../malware`).
+   - Hidden files (`~/.cron/`, `/var/db/.hidden_*`).
+
+2. **Suspicious arguments / behavior**
+   - `curl ... | sh` or `wget ... | bash` in ProgramArguments.
+   - `eval $(echo <base64>)`, `python -c "exec(...)"` with obfuscated payload.
+   - `nc -e /bin/sh`, reverse-shell patterns, `/dev/tcp/<ip>/<port>`.
+   - `osascript` with hidden window flags or AppleScript piped from network.
+   - LaunchAgent that re-downloads itself on every run.
+
+3. **Bundle/binary impersonation**
+   - Item claims to be Apple/known vendor by bundle ID but binary is in `/tmp`,
+     user homedir, or has wrong signature.
+   - "com.apple.*" bundle ID with no Apple signature.
+
+4. **Known malicious indicators**
+   - Specific TeamIDs/hashes/paths from documented macOS malware families
+     (XCSSET, Silver Sparrow, KeRanger, etc.) — only when you are certain.
+
+If none of those concrete indicators are present, the verdict must NOT be
+"malicious". Use "watchlist" for genuinely unknown unsigned items, "benign"
+otherwise.
+
+---
+
+## Verdict guide
+
+| Verdict | When |
+|---|---|
+| `benign` | Standard tooling, brew/MacPorts/conda packages, OS components, known good vendor TeamIDs. Ad-hoc signing in package-manager paths is fine. |
+| `watchlist` | Genuinely unusual but no concrete IoC — e.g. unsigned binary in `~/bin/` from unknown origin, or a LaunchAgent referencing an unknown developer. |
+| `malicious` | At least one concrete IoC from the list above. |
+
+Confidence reflects your certainty about the verdict. If you are guessing,
+return ≤ 0.6 and prefer the milder verdict.
+
+---
+
+## Output schema
+
+```
+{
+  "verdict": "benign" | "watchlist" | "malicious",
+  "confidence": 0.0-1.0,
+  "explanation": "1-3 sentences. Cite concrete signals. Do NOT regurgitate generic risk language.",
+  "mitreTechniques": ["T1543.001"] | null,
+  "extractedRule": {
+    "scope": "singleItem" | "pattern",
+    "clauses": [
+      {"kind": "teamIDEquals", "value": "ABC123XYZ"},
+      {"kind": "categoryEquals", "value": "launchAgent"},
+      {"kind": "bundleIDPrefix", "value": "homebrew.mxcl."}
+    ],
+    "rationale": "why this generalizes safely"
+  } | null
+}
+```
+
+### Rule extraction guidance
+
+- A `pattern` rule MUST anchor on identity: at least one of `teamIDEquals`,
+  `signatureValid`, `appleSigned`. If the item is ad-hoc signed and you cannot
+  anchor on identity, use `singleItem` scope (the rule will be saved bound to
+  this exact fingerprint only).
+- A `pattern` rule SHOULD have 2-4 clauses for specificity. Avoid single-clause
+  rules.
+- For Homebrew launchctl services, a useful pattern is
+  `[bundleIDPrefix=homebrew.mxcl., categoryEquals=launchAgent]` — but mark as
+  `singleItem` since there's no cryptographic anchor.
+- Set `extractedRule` to `null` if you cannot derive a safe generalization.
+
+### STRICT: clause kind whitelist
+
+The ONLY allowed values for `kind` are these exact strings. Do NOT invent new
+kinds. If your reasoning needs a kind not in this list, drop the clause or set
+`extractedRule` to null.
+
+| kind             | value type    | example                                    |
+|------------------|---------------|--------------------------------------------|
+| `teamIDEquals`   | string        | `{"kind":"teamIDEquals","value":"ABC123"}` |
+| `bundleIDEquals` | string        | `{"kind":"bundleIDEquals","value":"com.foo.bar"}` |
+| `bundleIDPrefix` | string        | `{"kind":"bundleIDPrefix","value":"homebrew.mxcl."}` |
+| `pathEquals`     | string        | `{"kind":"pathEquals","value":"/opt/homebrew/bin/foo"}` |
+| `pathPrefix`     | string (substring) | `{"kind":"pathPrefix","value":"/usr/local/lib/"}` |
+| `categoryEquals` | string (the actual macOS category, e.g. `launchAgent`, `launchDaemon`, `loginItem`, `cronJob`, `dylib`) | `{"kind":"categoryEquals","value":"launchAgent"}` |
+| `signatureValid` | NO value      | `{"kind":"signatureValid"}`                |
+| `appleSigned`    | NO value      | `{"kind":"appleSigned"}`                   |
+
+NEVER emit any of these (these are wrong):
+- `executablePathMatches`, `pathMatches`, regex-based clauses — not supported.
+- `isNotarized`, `notarized`, `hardenedRuntime`, `signed`, `verified` — not supported.
+- `categoryEquals` with invented categories like `dylib_hijacking`,
+  `suspicious_persistence` — categories are real macOS persistence types only.
+- `value` as boolean (`true`/`false`) or number — `value` is always a string,
+  except for `signatureValid` and `appleSigned` which take no value.
+
+If you can't build a rule using only the kinds above, return `"extractedRule": null`.
+
+### Style
+
+- `explanation` should mention WHAT specifically you observed (e.g.
+  "homebrew.mxcl bundle ID + ad-hoc signature + path under /opt/homebrew —
+  consistent with `brew services`"), not generic phrases like "multiple red
+  flags" or "aggressive persistence".
+- Be terse. 1-3 sentences.