fullcourtdefense-cli 1.14.14 → 1.14.16

package/dist/commands/discover.js

@@ -122,6 +122,20 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
 function candidateConfigPaths(cwd, extra) {
     return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
+/** Dot-dirs that hold a client's project config; the real project root is their parent. */
+const CONFIG_DOT_DIRS = new Set(['.cursor', '.claude', '.codex', '.vscode', '.gemini', '.kiro']);
+/** Map discovered project config file paths back to their owning project folders. */
+function deriveProjectRoots(candidates) {
+    const roots = new Set();
+    for (const candidate of candidates) {
+        let dir = path.dirname(candidate.path);
+        if (CONFIG_DOT_DIRS.has(path.basename(dir).toLowerCase())) {
+            dir = path.dirname(dir);
+        }
+        roots.add(path.resolve(dir));
+    }
+    return [...roots];
+}
 /** MCP servers can be declared under several keys across clients. */
 function extractServerMap(parsed) {
     if (!parsed || typeof parsed !== 'object')
@@ -300,7 +314,7 @@ function pushDiscoveredServer(out, name, cfgRaw, source, configPath) {
 function parseConfigFile(filePath, source) {
     let raw;
     try {
-        raw = fs.readFileSync(filePath, 'utf-8');
+        raw = fs.readFileSync(filePath, 'utf-8').replace(/^\uFEFF/, '');
     }
     catch {
         return [];
@@ -758,16 +772,23 @@ async function discoverCommand(args, config) {
     }
     if (args.schedule === 'daily' || args.schedule === 'logon') {
         const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
-        const surface = surfaces.size === 4 ? 'all' : Array.from(surfaces).join(',');
+        // Scheduled runs default to the FULL posture (mcp + secrets + agent-files +
+        // blast radius) unless the user explicitly narrowed the surface — a daily
+        // job should cover everything, not just MCP configs.
+        const explicitSurface = Boolean(args.surface || args.type);
+        const surface = !explicitSurface ? 'all' : (surfaces.size === 4 ? 'all' : Array.from(surfaces).join(','));
         (0, discoverSchedule_1.installDailyDiscoverSchedule)({
             userEmail: args.userEmail,
             hour: Number.isFinite(hour) ? hour : 9,
             surface,
+            scanRoot: args.scanRoot,
+            deepRoots: args.deepRoots === 'true',
             trigger: args.schedule,
         });
         if (!silent) {
             const when = args.schedule === 'logon' ? 'at logon' : `daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00`;
-            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --deep --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            const rootNote = args.scanRoot ? ` --scan-root ${args.scanRoot}` : '';
+            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --deep --silent${rootNote}${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
             console.log('Uses login Shield credentials or an explicit org API key.');
         }
         return;
@@ -777,29 +798,32 @@ async function discoverCommand(args, config) {
     const scanned = [];
     let found = [];
     let clientCoverage = [];
+    // Optional --scan-root sweep: find project-scoped MCP configs in OTHER repos
+    // under the given dev roots (bounded walk — see scanRootsForProjectConfigs).
+    // Computed once and shared across MCP, secrets, and agent-file scans so the
+    // whole posture references every mapped folder. Without the flag it is empty
+    // and behavior is exactly the known-locations scan.
+    const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
+    const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
+    const sweepProjectRoots = deriveProjectRoots(sweep.candidates);
+    const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath);
+    const secretConfigFiles = [...knownConfigCandidates, ...sweep.candidates]
+        .map(candidate => path.resolve(candidate.path))
+        .filter(file => fs.existsSync(file));
+    if (scanRoots.length > 0 && !silent) {
+        console.log(`${COLOR.gray}Scan-root sweep: checked ${sweep.scannedDirs} folder(s) under ${scanRoots.length} root(s) — found ${sweep.candidates.length} project config(s) across ${sweepProjectRoots.length} project folder(s).${COLOR.reset}`);
+    }
     const scanRootConfigPaths = new Set();
     if (runMcp) {
-        const candidates = candidateConfigPaths(cwd, args.extraPath);
-        // Optional --scan-root sweep: find project-scoped MCP configs in OTHER repos
-        // under the given dev roots (bounded walk — see scanRootsForProjectConfigs).
-        // Without the flag, behavior is exactly the known-locations scan.
-        const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
-        if (scanRoots.length > 0) {
-            const sweep = (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots);
-            const known = new Set(candidates.map(c => path.resolve(c.path).toLowerCase()));
-            let added = 0;
-            for (const candidate of sweep.candidates) {
-                const key = path.resolve(candidate.path).toLowerCase();
-                if (known.has(key))
-                    continue;
-                known.add(key);
-                candidates.push(candidate);
-                scanRootConfigPaths.add(key);
-                added += 1;
-            }
-            if (!silent) {
-                console.log(`${COLOR.gray}Scan-root sweep: checked ${sweep.scannedDirs} folder(s) under ${scanRoots.length} root(s) — found ${added} additional project config(s).${COLOR.reset}`);
-            }
+        const candidates = [...knownConfigCandidates];
+        const known = new Set(candidates.map(c => path.resolve(c.path).toLowerCase()));
+        for (const candidate of sweep.candidates) {
+            const key = path.resolve(candidate.path).toLowerCase();
+            if (known.has(key))
+                continue;
+            known.add(key);
+            candidates.push(candidate);
+            scanRootConfigPaths.add(key);
         }
         // Self-heal BEFORE parsing: configs written by old CLI versions can carry a stale
         // generic `--agent-name` that breaks dashboard policy matching. Fix them in place so
@@ -829,10 +853,10 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
-        ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd })
+        ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd, extraRoots: sweepProjectRoots })
         : undefined;
     const posture = surfaces.has('posture')
         ? (0, discoverBlastRadius_1.computeBlastRadius)({

package/dist/commands/discoverAgentFiles.d.ts

@@ -12,4 +12,5 @@ export interface AgentFileFinding {
 }
 export declare function scanAgentFiles(options?: {
     cwd?: string;
+    extraRoots?: string[];
 }): AgentFileFinding[];

package/dist/commands/discoverAgentFiles.js

@@ -182,27 +182,67 @@ function scanNamedFiles(roots, names, kind, titleFor, out, seen) {
         }
     }
 }
+/** Scan a single project root for agent instruction/rule/skill/hook files. */
+function scanProjectRootAgentFiles(root, clientLabel, out, seen) {
+    scanNamedFiles([{ root, client: clientLabel }], [
+        'AGENTS.md',
+        'CLAUDE.md',
+        'GEMINI.md',
+        '.cursorrules',
+        '.windsurfrules',
+    ], 'instructions', name => `Agent instructions (${name})`, out, seen);
+    scanNamedFiles([{ root: path.join(root, '.github'), client: 'github' }], [
+        'copilot-instructions.md',
+    ], 'instructions', () => 'GitHub Copilot instructions', out, seen);
+    for (const base of [
+        { dir: path.join(root, '.cursor', 'rules'), client: `Cursor (${clientLabel})`, kind: 'rules' },
+        { dir: path.join(root, '.agents', 'skills'), client: `Agents (${clientLabel})`, kind: 'skills' },
+    ]) {
+        if (!fs.existsSync(base.dir))
+            continue;
+        walkDir(base.dir, out, seen, (filePath, name) => name.endsWith('.md') || name.endsWith('.mdc') || name === 'SKILL.md', filePath => ({
+            kind: base.kind,
+            client: base.client,
+            filePath,
+            title: path.basename(filePath),
+            sizeBytes: 0,
+            lineCount: 0,
+        }));
+    }
+    const hooksPath = path.join(root, '.cursor', 'hooks.json');
+    if (fs.existsSync(hooksPath)) {
+        const parsed = readAgentFile(hooksPath);
+        if (parsed) {
+            pushFinding(out, seen, {
+                kind: 'hooks',
+                client: 'Cursor',
+                filePath: hooksPath,
+                title: 'Cursor hooks config',
+                sizeBytes: parsed.sizeBytes,
+                lineCount: parsed.lineCount,
+                content: parsed.content,
+                riskTags: parsed.content.includes('fullcourtdefense') ? [] : ['no_runtime_hook'],
+            });
+        }
+    }
+}
 function scanAgentFiles(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
     const out = [];
     const seen = new Set();
-    const projectRoots = [{ root: cwd, client: 'project' }, { root: home, client: 'user' }];
-    scanNamedFiles(projectRoots, [
+    // Current project + user-global locations.
+    scanProjectRootAgentFiles(cwd, 'project', out, seen);
+    scanNamedFiles([{ root: home, client: 'user' }], [
         'AGENTS.md',
         'CLAUDE.md',
         'GEMINI.md',
         '.cursorrules',
         '.windsurfrules',
     ], 'instructions', name => `Agent instructions (${name})`, out, seen);
-    scanNamedFiles([{ root: path.join(cwd, '.github'), client: 'github' }], [
-        'copilot-instructions.md',
-    ], 'instructions', () => 'GitHub Copilot instructions', out, seen);
     for (const base of [
         { dir: path.join(home, '.cursor', 'rules'), client: 'Cursor', kind: 'rules' },
-        { dir: path.join(cwd, '.cursor', 'rules'), client: 'Cursor (project)', kind: 'rules' },
         { dir: path.join(home, '.agents', 'skills'), client: 'Agents', kind: 'skills' },
-        { dir: path.join(cwd, '.agents', 'skills'), client: 'Agents (project)', kind: 'skills' },
     ]) {
         if (!fs.existsSync(base.dir))
             continue;
@@ -215,25 +255,31 @@ function scanAgentFiles(options = {}) {
             lineCount: 0,
         }));
     }
-    for (const hooksPath of [
-        path.join(home, '.cursor', 'hooks.json'),
-        path.join(cwd, '.cursor', 'hooks.json'),
-    ]) {
-        if (!fs.existsSync(hooksPath))
+    const homeHooks = path.join(home, '.cursor', 'hooks.json');
+    if (fs.existsSync(homeHooks)) {
+        const parsed = readAgentFile(homeHooks);
+        if (parsed) {
+            pushFinding(out, seen, {
+                kind: 'hooks',
+                client: 'Cursor',
+                filePath: homeHooks,
+                title: 'Cursor hooks config',
+                sizeBytes: parsed.sizeBytes,
+                lineCount: parsed.lineCount,
+                content: parsed.content,
+                riskTags: parsed.content.includes('fullcourtdefense') ? [] : ['no_runtime_hook'],
+            });
+        }
+    }
+    // Additional project roots (e.g. from `discover --scan-root`) — reference agent
+    // files in every mapped project, not just the current folder.
+    const cwdKey = path.resolve(cwd).toLowerCase();
+    for (const extra of options.extraRoots ?? []) {
+        if (path.resolve(extra).toLowerCase() === cwdKey)
             continue;
-        const parsed = readAgentFile(hooksPath);
-        if (!parsed)
+        if (!fs.existsSync(extra))
             continue;
-        pushFinding(out, seen, {
-            kind: 'hooks',
-            client: 'Cursor',
-            filePath: hooksPath,
-            title: 'Cursor hooks config',
-            sizeBytes: parsed.sizeBytes,
-            lineCount: parsed.lineCount,
-            content: parsed.content,
-            riskTags: parsed.content.includes('fullcourtdefense') ? [] : ['no_runtime_hook'],
-        });
+        scanProjectRootAgentFiles(extra, 'scanned project', out, seen);
     }
     out.sort((a, b) => b.riskTags.length - a.riskTags.length || b.sizeBytes - a.sizeBytes);
     return out;

package/dist/commands/discoverSchedule.d.ts

@@ -2,6 +2,8 @@ export interface ScheduleArgs {
     userEmail?: string;
     hour?: number;
     surface?: string;
+    scanRoot?: string;
+    deepRoots?: boolean;
     trigger?: 'daily' | 'logon';
 }
 export declare function installDailyDiscoverSchedule(args?: ScheduleArgs): void;

package/dist/commands/discoverSchedule.js

@@ -45,19 +45,23 @@ function windowsStartupLauncherPath() {
     const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
     return path.join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', STARTUP_LAUNCHER);
 }
-function discoverCommandLine(userEmail, surface) {
+function discoverCommandLine(opts = {}) {
     const node = process.execPath;
     const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
     const parts = [q(node), q(script), 'discover', '--upload', '--deep', '--silent'];
-    if (surface)
-        parts.push('--surface', q(surface));
-    if (userEmail)
-        parts.push('--user-email', q(userEmail));
+    if (opts.surface)
+        parts.push('--surface', q(opts.surface));
+    if (opts.scanRoot)
+        parts.push('--scan-root', q(opts.scanRoot));
+    if (opts.deepRoots)
+        parts.push('--deep-roots', 'true');
+    if (opts.userEmail)
+        parts.push('--user-email', q(opts.userEmail));
     return parts.join(' ');
 }
-function installWindowsSchedule(hour, userEmail, surface, trigger = 'daily') {
-    const tr = discoverCommandLine(userEmail, surface);
+function installWindowsSchedule(hour, opts, trigger = 'daily') {
+    const tr = discoverCommandLine(opts);
     try {
         (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'ignore' });
     }
@@ -79,12 +83,12 @@ function installWindowsSchedule(hour, userEmail, surface, trigger = 'daily') {
         console.log(`Task Scheduler denied access; installed user logon launcher instead: ${launcher}`);
     }
 }
-function installMacSchedule(hour, userEmail, surface, trigger = 'daily') {
+function installMacSchedule(hour, opts, trigger = 'daily') {
     const label = 'ai.fullcourtdefense.discover';
     const plistDir = path.join(os.homedir(), 'Library', 'LaunchAgents');
     const plistPath = path.join(plistDir, `${label}.plist`);
     fs.mkdirSync(plistDir, { recursive: true });
-    const cmd = discoverCommandLine(userEmail, surface).split(/\s+/);
+    const cmd = discoverCommandLine(opts).split(/\s+/);
     const program = cmd.shift() || process.execPath;
     const triggerXml = trigger === 'logon'
         ? '<key>RunAtLoad</key><true/>'
@@ -106,9 +110,9 @@ function installMacSchedule(hour, userEmail, surface, trigger = 'daily') {
     (0, child_process_1.spawnSync)('launchctl', ['unload', plistPath], { stdio: 'ignore' });
     (0, child_process_1.spawnSync)('launchctl', ['load', plistPath], { stdio: 'inherit' });
 }
-function installLinuxCron(hour, userEmail, surface, trigger = 'daily') {
+function installLinuxCron(hour, opts, trigger = 'daily') {
     const schedule = trigger === 'logon' ? '@reboot' : `0 ${hour} * * *`;
-    const line = `${schedule} ${discoverCommandLine(userEmail, surface)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
+    const line = `${schedule} ${discoverCommandLine(opts)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
     const marker = '# fullcourtdefense-discover';
     let crontab = '';
     try {
@@ -126,11 +130,11 @@ function installDailyDiscoverSchedule(args = {}) {
     const hour = Number.isFinite(args.hour) ? Math.min(23, Math.max(0, args.hour)) : 9;
     const trigger = args.trigger || 'daily';
     if (process.platform === 'win32')
-        installWindowsSchedule(hour, args.userEmail, args.surface, trigger);
+        installWindowsSchedule(hour, args, trigger);
     else if (process.platform === 'darwin')
-        installMacSchedule(hour, args.userEmail, args.surface, trigger);
+        installMacSchedule(hour, args, trigger);
     else
-        installLinuxCron(hour, args.userEmail, args.surface, trigger);
+        installLinuxCron(hour, args, trigger);
 }
 function uninstallDailyDiscoverSchedule() {
     if (process.platform === 'win32') {

package/dist/commands/discoverSecrets.d.ts

@@ -21,4 +21,6 @@ export interface SecretsScanResult {
 export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
+    extraRoots?: string[];
+    configFiles?: string[];
 }): SecretsScanResult;

package/dist/commands/discoverSecrets.js

@@ -57,13 +57,15 @@ const SECRET_PATTERNS = [
     { re: /\bgithub_pat_[a-zA-Z0-9_]{20,}\b/, provider: 'github', severity: 'critical', title: 'GitHub fine-grained PAT', impact: 'scoped access to your repositories' },
     { re: /\bglpat-[a-zA-Z0-9_-]{20,}\b/, provider: 'gitlab', severity: 'critical', title: 'GitLab personal access token', impact: 'read/write access to your GitLab projects' },
     { re: /\bAKIA[0-9A-Z]{16}\b/, provider: 'aws', severity: 'critical', title: 'AWS access key ID', impact: 'AWS API access (paired with its secret key)' },
-    { re: /\baws_secret_access_key\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/i, provider: 'aws', severity: 'critical', title: 'AWS secret access key', impact: 'full AWS API access for the paired key ID' },
+    { re: /\baws_secret_access_key\b['"]?\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/i, provider: 'aws', severity: 'critical', title: 'AWS secret access key', impact: 'full AWS API access for the paired key ID' },
     { re: /\bAIza[0-9A-Za-z_-]{35}\b/, provider: 'google', severity: 'critical', title: 'Google API key', impact: 'Google Cloud API usage billed to your project' },
     { re: /\bxox[baprs]-[a-zA-Z0-9-]{10,}\b/, provider: 'slack', severity: 'high', title: 'Slack token', impact: 'read/post messages as your Slack app or user' },
     { re: /\bhooks\.slack\.com\/services\/T[a-zA-Z0-9]+\/B[a-zA-Z0-9]+\/[a-zA-Z0-9]+\b/, provider: 'slack', severity: 'high', title: 'Slack incoming webhook URL', impact: 'post arbitrary messages into your Slack channel' },
     { re: /\bsk_live_[0-9a-zA-Z]{24,}\b/, provider: 'stripe', severity: 'critical', title: 'Stripe live secret key', impact: 'charges, refunds, and customer data in live mode' },
     { re: /\brk_live_[0-9a-zA-Z]{24,}\b/, provider: 'stripe', severity: 'critical', title: 'Stripe restricted key', impact: 'scoped live-mode payment operations' },
     { re: /\bSG\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\b/, provider: 'sendgrid', severity: 'high', title: 'SendGrid API key', impact: 'send email from your verified domains (phishing risk)' },
+    { re: /\bsbp_[a-zA-Z0-9_-]{20,}\b/, provider: 'supabase', severity: 'high', title: 'Supabase access token', impact: 'manage Supabase projects and data allowed by this token' },
+    { re: /\bfc-[a-fA-F0-9]{24,}\b/, provider: 'firecrawl', severity: 'medium', title: 'Firecrawl API key', impact: 'use web crawling/extraction quota billed to your account' },
     { re: /\bSK[0-9a-fA-F]{32}\b/, provider: 'twilio', severity: 'high', title: 'Twilio API key SID', impact: 'send SMS/calls billed to your account' },
     { re: /\bhf_[a-zA-Z0-9]{30,}\b/, provider: 'huggingface', severity: 'high', title: 'HuggingFace token', impact: 'access to your private models and datasets' },
     { re: /\bnpm_[a-zA-Z0-9]{36,}\b/, provider: 'npm', severity: 'high', title: 'npm access token', impact: 'publish packages as you (supply-chain risk)' },
@@ -98,6 +100,8 @@ const PROVIDER_REMEDIATION = {
     gcp_adc: 'Revoke the local ADC refresh token (`gcloud auth application-default revoke`) if unneeded, then re-auth with least-privilege accounts.',
     netrc: 'Remove plaintext passwords from .netrc or replace them with token helpers / OS keychain storage.',
     bearer: 'Rotate the token and avoid pasting bearer tokens into shell history or config files.',
+    supabase: 'Revoke this token in the Supabase dashboard and replace it with a scoped secret stored outside MCP config files.',
+    firecrawl: 'Rotate this API key in Firecrawl and store it in a secret manager or environment injected by the runtime.',
     url_basic_auth: 'Rotate the password/token embedded in the URL and replace it with environment or secret-manager lookup.',
     database: 'Change the database password and move the connection string to a secret manager; restrict the DB user\u2019s privileges.',
 };
@@ -301,7 +305,7 @@ function readTextFile(filePath) {
         const stat = fs.statSync(filePath);
         if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
             return null;
-        return fs.readFileSync(filePath, 'utf-8');
+        return fs.readFileSync(filePath, 'utf-8').replace(/^\uFEFF/, '');
     }
     catch {
         return null;
@@ -402,6 +406,7 @@ function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
     const maxDepth = options.maxEnvDepth ?? 4;
+    const extraRoots = options.extraRoots ?? [];
     const findings = [];
     const seen = new Set();
     let scannedFiles = 0;
@@ -430,6 +435,7 @@ function scanSecrets(options = {}) {
     const envRoots = Array.from(new Set([
         home,
         cwd,
+        ...extraRoots,
         path.join(home, 'dev'),
         path.join(home, 'repos'),
         path.join(home, 'projects'),
@@ -445,6 +451,19 @@ function scanSecrets(options = {}) {
         scannedFiles += 1;
         scanTextLines(envFile, content, 'env_file', findings, seen);
     }
+    // MCP/client config files are already discovered by the MCP inventory pass.
+    // Scan only those known files for embedded env/header/arg secrets; this catches
+    // real-world mistakes like GitHub/Slack tokens in MCP `env`, DB URLs in `args`,
+    // and Bearer tokens in remote MCP headers without expanding the filesystem scan.
+    for (const configFile of Array.from(new Set(options.configFiles ?? []))) {
+        if (findings.length >= MAX_FINDINGS)
+            break;
+        const content = readTextFile(configFile);
+        if (!content)
+            continue;
+        scannedFiles += 1;
+        scanTextLines(configFile, content, 'config', findings, seen);
+    }
     findings.sort((a, b) => {
         const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
         return order[a.severity] - order[b.severity] || a.filePath.localeCompare(b.filePath);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.14"
+  "version": "1.14.16"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.14",
+  "version": "1.14.16",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {