fullcourtdefense-cli 1.14.15 → 1.14.17

package/dist/commands/discover.js

@@ -314,7 +314,7 @@ function pushDiscoveredServer(out, name, cfgRaw, source, configPath) {
 function parseConfigFile(filePath, source) {
     let raw;
     try {
-        raw = fs.readFileSync(filePath, 'utf-8');
+        raw = fs.readFileSync(filePath, 'utf-8').replace(/^\uFEFF/, '');
     }
     catch {
         return [];
@@ -806,12 +806,16 @@ async function discoverCommand(args, config) {
     const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
     const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
     const sweepProjectRoots = deriveProjectRoots(sweep.candidates);
+    const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath);
+    const secretConfigFiles = [...knownConfigCandidates, ...sweep.candidates]
+        .map(candidate => path.resolve(candidate.path))
+        .filter(file => fs.existsSync(file));
     if (scanRoots.length > 0 && !silent) {
         console.log(`${COLOR.gray}Scan-root sweep: checked ${sweep.scannedDirs} folder(s) under ${scanRoots.length} root(s) — found ${sweep.candidates.length} project config(s) across ${sweepProjectRoots.length} project folder(s).${COLOR.reset}`);
     }
     const scanRootConfigPaths = new Set();
     if (runMcp) {
-        const candidates = candidateConfigPaths(cwd, args.extraPath);
+        const candidates = [...knownConfigCandidates];
         const known = new Set(candidates.map(c => path.resolve(c.path).toLowerCase()));
         for (const candidate of sweep.candidates) {
             const key = path.resolve(candidate.path).toLowerCase();
@@ -849,7 +853,7 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
         ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd, extraRoots: sweepProjectRoots })
@@ -863,19 +867,6 @@ async function discoverCommand(args, config) {
         })
         : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
-    if (args.json === 'true') {
-        console.log(JSON.stringify({
-            host,
-            surfaces: [...surfaces],
-            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
-            clientCoverage,
-            servers: found,
-            secrets,
-            agentFiles,
-            posture,
-        }, null, 2));
-        return;
-    }
     const home = os.homedir();
     const uploadExtras = {
         secrets,
@@ -915,6 +906,20 @@ async function discoverCommand(args, config) {
         }
         await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
+    if (args.json === 'true') {
+        await maybeUpload();
+        console.log(JSON.stringify({
+            host,
+            surfaces: [...surfaces],
+            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
+            clientCoverage,
+            servers: found,
+            secrets,
+            agentFiles,
+            posture,
+        }, null, 2));
+        return;
+    }
     if (silent) {
         if (uploadRequested) {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });

package/dist/commands/discoverSecrets.d.ts

@@ -22,4 +22,5 @@ export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
     extraRoots?: string[];
+    configFiles?: string[];
 }): SecretsScanResult;

package/dist/commands/discoverSecrets.js

@@ -57,13 +57,15 @@ const SECRET_PATTERNS = [
     { re: /\bgithub_pat_[a-zA-Z0-9_]{20,}\b/, provider: 'github', severity: 'critical', title: 'GitHub fine-grained PAT', impact: 'scoped access to your repositories' },
     { re: /\bglpat-[a-zA-Z0-9_-]{20,}\b/, provider: 'gitlab', severity: 'critical', title: 'GitLab personal access token', impact: 'read/write access to your GitLab projects' },
     { re: /\bAKIA[0-9A-Z]{16}\b/, provider: 'aws', severity: 'critical', title: 'AWS access key ID', impact: 'AWS API access (paired with its secret key)' },
-    { re: /\baws_secret_access_key\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/i, provider: 'aws', severity: 'critical', title: 'AWS secret access key', impact: 'full AWS API access for the paired key ID' },
+    { re: /\baws_secret_access_key\b['"]?\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/i, provider: 'aws', severity: 'critical', title: 'AWS secret access key', impact: 'full AWS API access for the paired key ID' },
     { re: /\bAIza[0-9A-Za-z_-]{35}\b/, provider: 'google', severity: 'critical', title: 'Google API key', impact: 'Google Cloud API usage billed to your project' },
     { re: /\bxox[baprs]-[a-zA-Z0-9-]{10,}\b/, provider: 'slack', severity: 'high', title: 'Slack token', impact: 'read/post messages as your Slack app or user' },
     { re: /\bhooks\.slack\.com\/services\/T[a-zA-Z0-9]+\/B[a-zA-Z0-9]+\/[a-zA-Z0-9]+\b/, provider: 'slack', severity: 'high', title: 'Slack incoming webhook URL', impact: 'post arbitrary messages into your Slack channel' },
     { re: /\bsk_live_[0-9a-zA-Z]{24,}\b/, provider: 'stripe', severity: 'critical', title: 'Stripe live secret key', impact: 'charges, refunds, and customer data in live mode' },
     { re: /\brk_live_[0-9a-zA-Z]{24,}\b/, provider: 'stripe', severity: 'critical', title: 'Stripe restricted key', impact: 'scoped live-mode payment operations' },
     { re: /\bSG\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\b/, provider: 'sendgrid', severity: 'high', title: 'SendGrid API key', impact: 'send email from your verified domains (phishing risk)' },
+    { re: /\bsbp_[a-zA-Z0-9_-]{20,}\b/, provider: 'supabase', severity: 'high', title: 'Supabase access token', impact: 'manage Supabase projects and data allowed by this token' },
+    { re: /\bfc-[a-fA-F0-9]{24,}\b/, provider: 'firecrawl', severity: 'medium', title: 'Firecrawl API key', impact: 'use web crawling/extraction quota billed to your account' },
     { re: /\bSK[0-9a-fA-F]{32}\b/, provider: 'twilio', severity: 'high', title: 'Twilio API key SID', impact: 'send SMS/calls billed to your account' },
     { re: /\bhf_[a-zA-Z0-9]{30,}\b/, provider: 'huggingface', severity: 'high', title: 'HuggingFace token', impact: 'access to your private models and datasets' },
     { re: /\bnpm_[a-zA-Z0-9]{36,}\b/, provider: 'npm', severity: 'high', title: 'npm access token', impact: 'publish packages as you (supply-chain risk)' },
@@ -98,6 +100,8 @@ const PROVIDER_REMEDIATION = {
     gcp_adc: 'Revoke the local ADC refresh token (`gcloud auth application-default revoke`) if unneeded, then re-auth with least-privilege accounts.',
     netrc: 'Remove plaintext passwords from .netrc or replace them with token helpers / OS keychain storage.',
     bearer: 'Rotate the token and avoid pasting bearer tokens into shell history or config files.',
+    supabase: 'Revoke this token in the Supabase dashboard and replace it with a scoped secret stored outside MCP config files.',
+    firecrawl: 'Rotate this API key in Firecrawl and store it in a secret manager or environment injected by the runtime.',
     url_basic_auth: 'Rotate the password/token embedded in the URL and replace it with environment or secret-manager lookup.',
     database: 'Change the database password and move the connection string to a secret manager; restrict the DB user\u2019s privileges.',
 };
@@ -301,7 +305,7 @@ function readTextFile(filePath) {
         const stat = fs.statSync(filePath);
         if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
             return null;
-        return fs.readFileSync(filePath, 'utf-8');
+        return fs.readFileSync(filePath, 'utf-8').replace(/^\uFEFF/, '');
     }
     catch {
         return null;
@@ -398,6 +402,48 @@ function collectEnvFiles(roots, maxDepth) {
     }
     return found;
 }
+function collectProjectCredentialFiles(roots, maxDepth) {
+    const found = [];
+    const queue = roots.map(dir => ({ dir, depth: 0 }));
+    const isCredentialFile = (filePath) => {
+        const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+        const base = path.basename(normalized);
+        return base === '.npmrc'
+            || base === '.pypirc'
+            || base === '.netrc'
+            || normalized.endsWith('/.docker/config.json')
+            || normalized.endsWith('/.kube/config')
+            || normalized.endsWith('/gcloud/application_default_credentials.json');
+    };
+    while (queue.length > 0 && found.length < MAX_ENV_FILES) {
+        const { dir, depth } = queue.shift();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (found.length >= MAX_ENV_FILES)
+                break;
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (depth >= maxDepth)
+                    continue;
+                if (SKIP_DIR_NAMES.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.') && !['.cursor', '.claude', '.codex', '.vscode', '.docker', '.kube', '.config'].includes(entry.name))
+                    continue;
+                queue.push({ dir: full, depth: depth + 1 });
+                continue;
+            }
+            if (entry.isFile() && isCredentialFile(full))
+                found.push(full);
+        }
+    }
+    return found;
+}
 function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
@@ -447,6 +493,29 @@ function scanSecrets(options = {}) {
         scannedFiles += 1;
         scanTextLines(envFile, content, 'env_file', findings, seen);
     }
+    for (const credentialFile of collectProjectCredentialFiles([cwd, ...extraRoots], maxDepth)) {
+        if (findings.length >= MAX_FINDINGS)
+            break;
+        const content = readTextFile(credentialFile);
+        if (!content)
+            continue;
+        scannedFiles += 1;
+        scanTextLines(credentialFile, content, 'credential_store', findings, seen);
+        scanCredentialStorePosture(credentialFile, content, 'credential_store', findings, seen);
+    }
+    // MCP/client config files are already discovered by the MCP inventory pass.
+    // Scan only those known files for embedded env/header/arg secrets; this catches
+    // real-world mistakes like GitHub/Slack tokens in MCP `env`, DB URLs in `args`,
+    // and Bearer tokens in remote MCP headers without expanding the filesystem scan.
+    for (const configFile of Array.from(new Set(options.configFiles ?? []))) {
+        if (findings.length >= MAX_FINDINGS)
+            break;
+        const content = readTextFile(configFile);
+        if (!content)
+            continue;
+        scannedFiles += 1;
+        scanTextLines(configFile, content, 'config', findings, seen);
+    }
     findings.sort((a, b) => {
         const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
         return order[a.severity] - order[b.severity] || a.filePath.localeCompare(b.filePath);

package/dist/commands/mcpGateway.js

@@ -759,6 +759,7 @@ class McpGatewayServer {
                     shieldKey: this.gatewayConfig.shieldKey,
                     developerName: this.gatewayConfig.developerName,
                     machineName: os.hostname(),
+                    force: true,
                 });
                 if (bundle.source !== 'default')
                     expectedPolicyHash = bundle.policyHash || bundle.version;
@@ -1159,7 +1160,7 @@ async function installMcpGatewayCommand(args, config) {
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
         apiUrl: args.apiUrl,
-    }, { requireOrganizationId: false });
+    }, { requireApiKey: false, requireOrganizationId: false });
     const cursorProject = args.cursorProject === 'true';
     const selection = parseClientList(args.clients);
     const clients = selection === 'auto'
@@ -1748,7 +1749,7 @@ function protectAllTargetFiles(extra, allowedClientKeys) {
     return files;
 }
 async function protectAllCommand(args, config) {
-    (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireOrganizationId: false });
+    (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireApiKey: false, requireOrganizationId: false });
     const gatewayConfig = resolveGatewayConfig(args, config);
     const dryRun = args.dryRun === 'true';
     const allowedClientKeys = resolveProtectClientKeys(args.clients);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.15"
+  "version": "1.14.17"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.15",
+  "version": "1.14.17",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -26,6 +26,7 @@
     "test:discover-stdio-mcp": "npm run build && node scripts/test-discover-stdio-mcp-tools.js",
     "test:per-server-agent-name": "npm run build && node scripts/test-per-server-agent-name.js",
     "test:remote-mcp-gateway": "npm run build && node scripts/test-remote-mcp-gateway.js",
+    "test:e2e-onboarding-personas": "npm run build && node scripts/test-e2e-onboarding-personas.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"