Skip to content
SuperAlign Surface
Esc
↑↓navigate↵open⌘Jpreview
On this page

Files, services, and logs

Where the scanner lives on each platform, what the services are called, and where to find logs.

File locations

macOS Linux Windows
Binary /opt/surface/bin/surface /usr/bin/surface %ProgramData%\Surface\bin\surface.exe
Data /var/lib/surface /var/lib/surface %ProgramData%\Surface
Credentials /var/lib/surface/credentials.json /var/lib/surface/credentials.json %ProgramData%\Surface\credentials.json
MDM setting /Library/Managed Preferences/com.superalign.surface.plist /etc/surface/managed.conf HKLM\SOFTWARE\Policies\Superalign\Surface
Logs /var/lib/surface/logs/ /var/lib/surface/logs/ %ProgramData%\Surface\logs\
Install log /var/log/surface-install.log /var/log/surface-install.log %ProgramData%\Surface\install.log
Desktop app /Applications/Surface.app /usr/bin/surface-ui %ProgramData%\Surface\bin\SurfaceUI.exe

Credentials are readable only by the system account. The server keeps only a hash of the laptop’s secret.

Services

Platform Scanner Tray
macOS LaunchDaemon com.superalign.surface LaunchAgent com.superalign.surface.tray
Linux systemd surface.service Autostart surface-tray.desktop
Windows Service SurfaceScanner Scheduled task SurfaceTray

Check the service:

sudo launchctl print system/com.superalign.surface
systemctl status surface.service
Get-Service SurfaceScanner

Logs

sudo surface logs reads the main log for you. The files:

File Contents
surface.log The scanner. Capped at 200 MB or 30 days
surface.error.log Crashes and output from the service manager
tray.log The tray indicator
extensions/<slug>.log One file per prompt collector
update.log Self-update

When you run surface scan --once by hand, output goes to the terminal, not the log file.

The tray and the desktop app

The scanner installs a menu bar (macOS) or system tray (Windows, Linux) icon that runs as the signed-in person. It shows:

  • The scanner version
  • Usage: the person’s own AI plan usage for Claude and OpenAI accounts signed in on this laptop. Shown here only, never sent to the console
  • My Device: opens the desktop app, which shows this laptop’s own page from the console
  • Account: the signed-in email, or a prompt to run surface init if the sign-in expired
  • Status: active when connected to the scanner

When a decision blocks or warns about a tool on this laptop, the tray shows a system notification titled BLOCKED or WARNING with the tool’s name.

Was this page helpful?