Add persistence scanner, scan history, notifications, and native-panel UI

README.md

@@ -9,18 +9,24 @@ An [Omarchy](https://omarchy.com) bar-widget plugin that shows a live security b
 ## Features
 
 - Live badge: green when clean, amber on warnings, red when compromised
-- Popup breakdown per scanner with last-scan timestamp
+- Popup breakdown per scanner with last-scan timestamp, and a "next scan in Xh" line (or "skipped Xm ago (game active)" when GameMode preempted a run)
 - Manual "Scan now" button in popup
 - Per-project one-shot scan buttons (bun-check, bumblebee)
-- **All three scanners are optional** — sections only appear when the tool is installed
+- **All scanners are optional** except persistence — sections only appear when the tool is installed
+- **AUR-Malware and persistence detail views**: "View detail" opens a breakdown of every failed/warned check, grouped by the package or reason behind it when one can be identified (an infected package name, an `/etc/hosts` comment, the package owning a flagged file). Findings from heuristic checks (not the ones that are direct evidence of an actual compromise) can be dismissed as a reviewed false positive — dismissed findings stay visible, dimmed, with a one-click undo, and stop counting toward the badge color until the underlying finding changes
+- **Scan history**: a compact, capped log of past scans (clock icon in the header), so a one-off finding that's since cleared still left a trace instead of just vanishing on the next overwrite
+- **Desktop notification** on genuinely new active findings (fingerprint-tracked, so already-seen or already-dismissed ones stay quiet) — the badge color alone is invisible to anyone not already looking at the bar
+- Skips the scheduled scan while GameMode reports an active game (rather than competing for CPU/IO or silently going stale), and says so in the popup instead of just looking like it stopped running
+- Panel follows the same design language as Omarchy's own bar panels (Audio, Network, Bluetooth...): keyboard navigation (Escape closes, Tab switches between bar panels), themed colors, same section-spacing conventions
 
 ## Scanners
 
 | Scanner | What it checks | How to install |
 |---|---|---|
-| **AUR-Malware** | Atomic Arch IOC scan — pacman/AUR packages, npm/bun caches, eBPF rootkit artifacts, hidden processes | Clone [AUR-Malware](https://github.com/Atomic-Arch/AUR-Malware) to `/local/applications/AUR-Malware/` |
+| **AUR-Malware** | Atomic Arch IOC scan — pacman/AUR packages, npm/bun caches, eBPF rootkit artifacts, hidden processes | Clone [AUR-Malware](https://github.com/nightdevil00/AUR-Malware) to `~/.local/share/AUR-Malware/` (the original `Atomic-Arch/AUR-Malware` this pointed at is gone; this fork ships the same `check-atomic-arch_new.sh`) |
 | **[bumblebee](https://github.com/perplexityai/bumblebee)** | Endpoint package inventory across npm, pypi, go, rubygems, homebrew, etc. | `GOBIN=$HOME/.local/bin go install github.com/perplexityai/bumblebee@latest` |
 | **bun-check** | Per-project dev-env one-shot scan (opens a terminal picker) | Bundled — run `install.sh` after adding the plugin |
+| **persistence** | Bash-only, no install step. Scans autostart `.desktop` entries, user systemd units and crontab for the same injection pattern (`curl\|bash`, `eval "$(curl...)"`, etc.) AUR-Malware already checks shell configs for | Always active |
 
 The bun-check one-shot script (`qs-bun-check-oneshot.sh`) is included in this repo. After `omarchy plugin add`, run the optional install step:
 
@@ -38,6 +44,10 @@ QS_SEC_BUMBLEBEE=bumblebee
 QS_SEC_BUMBLEBEE_CATALOG=~/.local/share/qs-security/threat-intel
 QS_BUN_CHECK=/path/to/bun-checkV2.sh
 QS_SEC_STATUS_FILE=~/.cache/qs-security-status.json
+QS_SEC_LAST_RUN_FILE=~/.cache/qs-security-last-run.json
+QS_SEC_HISTORY_FILE=~/.local/share/qs-security/history.json
+QS_SEC_NOTIFIED_FILE=~/.config/qs-security/notified.json
+QS_SEC_DISMISSED_FILE=~/.config/qs-security/dismissed.json
 ```
 
 ## How it works