fullcourtdefense-cli 1.14.16 → 1.14.17

package/dist/commands/discover.js

@@ -867,19 +867,6 @@ async function discoverCommand(args, config) {
         })
         : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
-    if (args.json === 'true') {
-        console.log(JSON.stringify({
-            host,
-            surfaces: [...surfaces],
-            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
-            clientCoverage,
-            servers: found,
-            secrets,
-            agentFiles,
-            posture,
-        }, null, 2));
-        return;
-    }
     const home = os.homedir();
     const uploadExtras = {
         secrets,
@@ -919,6 +906,20 @@ async function discoverCommand(args, config) {
         }
         await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
+    if (args.json === 'true') {
+        await maybeUpload();
+        console.log(JSON.stringify({
+            host,
+            surfaces: [...surfaces],
+            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
+            clientCoverage,
+            servers: found,
+            secrets,
+            agentFiles,
+            posture,
+        }, null, 2));
+        return;
+    }
     if (silent) {
         if (uploadRequested) {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });

package/dist/commands/discoverSecrets.js

@@ -402,6 +402,48 @@ function collectEnvFiles(roots, maxDepth) {
     }
     return found;
 }
+function collectProjectCredentialFiles(roots, maxDepth) {
+    const found = [];
+    const queue = roots.map(dir => ({ dir, depth: 0 }));
+    const isCredentialFile = (filePath) => {
+        const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+        const base = path.basename(normalized);
+        return base === '.npmrc'
+            || base === '.pypirc'
+            || base === '.netrc'
+            || normalized.endsWith('/.docker/config.json')
+            || normalized.endsWith('/.kube/config')
+            || normalized.endsWith('/gcloud/application_default_credentials.json');
+    };
+    while (queue.length > 0 && found.length < MAX_ENV_FILES) {
+        const { dir, depth } = queue.shift();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (found.length >= MAX_ENV_FILES)
+                break;
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (depth >= maxDepth)
+                    continue;
+                if (SKIP_DIR_NAMES.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.') && !['.cursor', '.claude', '.codex', '.vscode', '.docker', '.kube', '.config'].includes(entry.name))
+                    continue;
+                queue.push({ dir: full, depth: depth + 1 });
+                continue;
+            }
+            if (entry.isFile() && isCredentialFile(full))
+                found.push(full);
+        }
+    }
+    return found;
+}
 function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
@@ -451,6 +493,16 @@ function scanSecrets(options = {}) {
         scannedFiles += 1;
         scanTextLines(envFile, content, 'env_file', findings, seen);
     }
+    for (const credentialFile of collectProjectCredentialFiles([cwd, ...extraRoots], maxDepth)) {
+        if (findings.length >= MAX_FINDINGS)
+            break;
+        const content = readTextFile(credentialFile);
+        if (!content)
+            continue;
+        scannedFiles += 1;
+        scanTextLines(credentialFile, content, 'credential_store', findings, seen);
+        scanCredentialStorePosture(credentialFile, content, 'credential_store', findings, seen);
+    }
     // MCP/client config files are already discovered by the MCP inventory pass.
     // Scan only those known files for embedded env/header/arg secrets; this catches
     // real-world mistakes like GitHub/Slack tokens in MCP `env`, DB URLs in `args`,

package/dist/commands/mcpGateway.js

@@ -759,6 +759,7 @@ class McpGatewayServer {
                     shieldKey: this.gatewayConfig.shieldKey,
                     developerName: this.gatewayConfig.developerName,
                     machineName: os.hostname(),
+                    force: true,
                 });
                 if (bundle.source !== 'default')
                     expectedPolicyHash = bundle.policyHash || bundle.version;
@@ -1159,7 +1160,7 @@ async function installMcpGatewayCommand(args, config) {
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
         apiUrl: args.apiUrl,
-    }, { requireOrganizationId: false });
+    }, { requireApiKey: false, requireOrganizationId: false });
     const cursorProject = args.cursorProject === 'true';
     const selection = parseClientList(args.clients);
     const clients = selection === 'auto'
@@ -1748,7 +1749,7 @@ function protectAllTargetFiles(extra, allowedClientKeys) {
     return files;
 }
 async function protectAllCommand(args, config) {
-    (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireOrganizationId: false });
+    (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireApiKey: false, requireOrganizationId: false });
     const gatewayConfig = resolveGatewayConfig(args, config);
     const dryRun = args.dryRun === 'true';
     const allowedClientKeys = resolveProtectClientKeys(args.clients);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.16"
+  "version": "1.14.17"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.16",
+  "version": "1.14.17",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -26,6 +26,7 @@
     "test:discover-stdio-mcp": "npm run build && node scripts/test-discover-stdio-mcp-tools.js",
     "test:per-server-agent-name": "npm run build && node scripts/test-per-server-agent-name.js",
     "test:remote-mcp-gateway": "npm run build && node scripts/test-remote-mcp-gateway.js",
+    "test:e2e-onboarding-personas": "npm run build && node scripts/test-e2e-onboarding-personas.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"