fullcourtdefense-cli 1.14.16 → 1.15.0

package/README.md

@@ -12,22 +12,36 @@ npm install -g fullcourtdefense-cli
 npx fullcourtdefense-cli scan
 ```
 
-## Quick Start
+## Quick Start (protect this machine)
+
+One command takes a fresh machine to a verified protected machine: connectivity check, fleet enrollment, MCP gateway wrapping, IDE hooks, terminal guards, discovery upload, and a green/red verification checklist.
 
 ```bash
-# Show onboarding help
-fullcourtdefense help
+# An org admin issues a fleet enrollment token in the web app:
+# AI Fleet -> Settings -> Fleet enrollment token
 
-# 1. Check outbound HTTPS from the customer machine
-fullcourtdefense doctor
+fullcourtdefense onboard --token <fleet-enrollment-token>
+# or: set FCD_ENROLL_TOKEN and run `fullcourtdefense onboard`
+```
 
-# 2. Save Shield ID and Shield key
-fullcourtdefense configure
+Then restart your AI clients (Cursor, Claude, VS Code, ...) so they pick up the wrapped configs. The machine reports to your org's AI Fleet in monitor-first mode until an admin enables enforcement.
+
+Manual step-by-step equivalent:
 
-# 3. Run an in-organization local scan with guided questions
+```bash
+fullcourtdefense doctor                                 # 1. outbound HTTPS check
+fullcourtdefense login --token <fleet-enrollment-token> # 2. enroll (zero paste)
+fullcourtdefense install-all                            # 3. protect every AI client
+fullcourtdefense protect-all --dry-run true             # 4. verify gateways
+```
+
+## Quick Start (scanning)
+
+```bash
+# Run an in-organization local scan with guided questions
 fullcourtdefense scan --local
 
-# 4. Run a detailed MCP report
+# Run a detailed MCP report
 fullcourtdefense scan --local --type mcp --mcp-command node --mcp-args ./server.js --mcp-tool all --mode full --format report
 
 # Hosted CI/CD scan, if using an API key instead of local Shield scan
@@ -43,8 +57,11 @@ fullcourtdefense init
 ## Command Guide
 
 - `fullcourtdefense help` — shows the full onboarding flow and command reference.
+- `fullcourtdefense onboard --token <token>` — one command: doctor + login + install-all + verification checklist (exits non-zero if a required surface failed — safe for MDM scripts).
 - `fullcourtdefense doctor` — confirms outbound HTTPS to FullCourtDefense is open before scanning.
-- `fullcourtdefense configure` — saves Shield ID, Shield key, and API URL to `.fullcourtdefense.yml`.
+- `fullcourtdefense login --token <token>` — enrolls this machine with a fleet token and saves per-machine Shield credentials (no copy/paste).
+- `fullcourtdefense install-all` — wraps every configured MCP server, installs IDE hooks and terminal guards, uploads discovery, schedules daily rescans.
+- `fullcourtdefense configure` — legacy/manual setup: saves org API key, Shield ID, Shield key, and API URL to `.fullcourtdefense.yml` (use `login` instead when you have a fleet token).
 - `fullcourtdefense scan --local` — runs inside the customer network and asks whether to scan endpoint, MCP, or RAG.
 - `fullcourtdefense scan --local --type mcp ...` — launches a local stdio MCP server, calls tools, and sends tool responses to Shield.
 - `fullcourtdefense scan --local --type rag ...` — scans local RAG files/directories or a live RAG HTTP service.

package/dist/commands/daemon.d.ts

@@ -0,0 +1,10 @@
+import { BotGuardConfig } from '../config';
+import { ProtectAllArgs } from './mcpGateway';
+export interface DaemonArgs extends ProtectAllArgs {
+    install?: string;
+    uninstall?: string;
+    status?: string;
+    /** Suppress OS toasts (still logs). */
+    quiet?: string;
+}
+export declare function daemonCommand(args: DaemonArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/daemon.js

@@ -0,0 +1,498 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonCommand = daemonCommand;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const config_1 = require("../config");
+const mcpGateway_1 = require("./mcpGateway");
+const runtimeConfig_1 = require("../runtimeConfig");
+const telemetry_1 = require("../telemetry");
+const notify_1 = require("../notify");
+const COLOR = {
+    reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+    red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
+};
+const TASK_NAME = 'FullCourtDefense Daemon';
+const CRON_MARKER = '# FCD_DAEMON';
+const LAUNCHD_LABEL = 'ai.fullcourtdefense.daemon';
+const SYSTEMD_UNIT = 'fullcourtdefense-daemon.service';
+function envMs(name, fallback) {
+    const value = Number(process.env[name]);
+    return Number.isFinite(value) && value > 0 ? value : fallback;
+}
+/** How long after our own protect-all writes we ignore watcher events (self-inflicted churn). */
+const SELF_WRITE_QUIET_MS = envMs('FCD_DAEMON_QUIET_MS', 5_000);
+/** Debounce window for filesystem events before re-protecting. */
+const DEBOUNCE_MS = envMs('FCD_DAEMON_DEBOUNCE_MS', 2_000);
+/** Re-enumerate config files this often to pick up newly installed clients. */
+const RESCAN_INTERVAL_MS = envMs('FCD_DAEMON_RESCAN_MS', 5 * 60_000);
+/** Heartbeat / spool flush cadence. */
+const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
+/** Bundle (mode / suspension / policy version) poll cadence. */
+const BUNDLE_POLL_MS = envMs('FCD_DAEMON_BUNDLE_POLL_MS', 60_000);
+/** Rotate the daemon log when it grows past this size. */
+const LOG_MAX_BYTES = 1_000_000;
+function daemonDir() {
+    return path.join(os.homedir(), '.fullcourtdefense');
+}
+function pidFile() {
+    return path.join(daemonDir(), 'daemon.pid');
+}
+function logFile() {
+    return path.join(daemonDir(), 'daemon.log');
+}
+function cliEntry() {
+    return path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+}
+function log(message) {
+    const line = `[${new Date().toISOString()}] ${message}`;
+    console.log(line);
+    try {
+        fs.mkdirSync(daemonDir(), { recursive: true });
+        const file = logFile();
+        try {
+            if (fs.existsSync(file) && fs.statSync(file).size > LOG_MAX_BYTES) {
+                fs.renameSync(file, `${file}.1`);
+            }
+        }
+        catch { /* rotation is best-effort */ }
+        fs.appendFileSync(file, `${line}\n`, 'utf8');
+    }
+    catch { /* logging must never kill the daemon */ }
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+/** Take the single-instance lock. Returns false when another daemon is already running. */
+function acquirePidLock() {
+    fs.mkdirSync(daemonDir(), { recursive: true });
+    try {
+        const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
+        if (Number.isFinite(existing) && existing > 0 && existing !== process.pid && isPidAlive(existing)) {
+            return false;
+        }
+    }
+    catch { /* no pidfile — free to start */ }
+    fs.writeFileSync(pidFile(), String(process.pid), 'utf8');
+    return true;
+}
+function releasePidLock() {
+    try {
+        const recorded = Number(fs.readFileSync(pidFile(), 'utf8').trim());
+        if (recorded === process.pid)
+            fs.unlinkSync(pidFile());
+    }
+    catch { /* best-effort */ }
+}
+/** Cursor/Claude hook config files worth watching for tamper (deletion/rewrite). */
+function hookConfigFiles() {
+    const home = os.homedir();
+    return [
+        path.join(home, '.cursor', 'hooks.json'),
+        path.join(home, '.claude', 'settings.json'),
+    ].filter(file => fs.existsSync(file));
+}
+// ---------------------------------------------------------------------------
+// The resident loop
+// ---------------------------------------------------------------------------
+async function runDaemon(args, config) {
+    if (!acquirePidLock()) {
+        console.log(`${COLOR.yellow}Another FullCourtDefense daemon is already running (pid file: ${pidFile()}).${COLOR.reset}`);
+        return;
+    }
+    const creds = (0, config_1.resolveCliCredentials)(config, {
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    });
+    const quiet = args.quiet === 'true';
+    log(`Daemon started (pid ${process.pid}, platform ${process.platform}).`);
+    log(`Shield: ${creds.shieldId || '(none — protect-only mode, telemetry disabled)'}  API: ${creds.apiUrl}`);
+    // --- state ---------------------------------------------------------------
+    const watchers = new Map(); // directory -> watcher
+    const watchedFiles = new Set(); // lowercased absolute file paths we react to
+    let quietUntil = 0; // ignore events until this time (self-writes)
+    let debounceTimer = null;
+    let reprotecting = false;
+    let suspended = false;
+    let stopped = false;
+    const reprotect = async (reasonPaths) => {
+        if (reprotecting || stopped)
+            return;
+        if (suspended) {
+            log(`Config drift detected (${reasonPaths.join(', ')}) but machine is suspended — not re-protecting.`);
+            return;
+        }
+        reprotecting = true;
+        quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
+        log(`Config drift detected: ${reasonPaths.join(', ')} — re-running protect-all.`);
+        try {
+            await (0, mcpGateway_1.protectAllCommand)({ ...args, dryRun: undefined }, config);
+            quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
+            log('Re-protection pass complete.');
+            if (!quiet) {
+                (0, notify_1.notifyOs)({
+                    title: 'FullCourtDefense re-protected this machine',
+                    message: 'An MCP or hook config changed; the AgentGuard gateway was re-applied.',
+                    url: (0, notify_1.consoleUrl)('/agent-security/users?view=desktop'),
+                });
+            }
+        }
+        catch (error) {
+            log(`Re-protection failed: ${error.message}`);
+        }
+        finally {
+            reprotecting = false;
+        }
+    };
+    const onFsEvent = (dir, filename) => {
+        if (stopped || Date.now() < quietUntil)
+            return;
+        const full = filename ? path.resolve(dir, filename.toString()) : dir;
+        const key = full.toLowerCase();
+        // Ignore our own backup files and unrelated churn in watched directories.
+        if (key.includes('.fcd-backup-'))
+            return;
+        if (filename && !watchedFiles.has(key))
+            return;
+        if (debounceTimer)
+            clearTimeout(debounceTimer);
+        debounceTimer = setTimeout(() => { void reprotect([full]); }, DEBOUNCE_MS);
+    };
+    /**
+     * (Re)build the watch set from the current MCP client configs + hook files.
+     * Watches parent directories (not files) so atomic replaces on Windows and
+     * editor save-via-rename still emit events.
+     */
+    const refreshWatchTargets = () => {
+        const targets = [
+            ...(0, mcpGateway_1.protectAllTargetFiles)(args.config).map(f => f.path),
+            ...hookConfigFiles(),
+        ];
+        watchedFiles.clear();
+        const wantedDirs = new Set();
+        for (const file of targets) {
+            watchedFiles.add(path.resolve(file).toLowerCase());
+            wantedDirs.add(path.dirname(path.resolve(file)));
+        }
+        for (const [dir, watcher] of watchers) {
+            if (!wantedDirs.has(dir)) {
+                watcher.close();
+                watchers.delete(dir);
+            }
+        }
+        for (const dir of wantedDirs) {
+            if (watchers.has(dir))
+                continue;
+            try {
+                const watcher = fs.watch(dir, (_event, filename) => onFsEvent(dir, filename ? String(filename) : null));
+                watcher.on('error', () => { watcher.close(); watchers.delete(dir); });
+                watchers.set(dir, watcher);
+            }
+            catch { /* directory may vanish; the rescan tick re-tries */ }
+        }
+        return targets.length;
+    };
+    const pollBundle = async () => {
+        if (!creds.shieldId)
+            return;
+        try {
+            const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                apiUrl: creds.apiUrl,
+                shieldId: creds.shieldId,
+                shieldKey: creds.shieldKey,
+                force: true,
+            });
+            if (bundle.suspended && !suspended) {
+                suspended = true;
+                log('Machine SUSPENDED by admin — hooks/gateway deny all actions; daemon pauses re-protection.');
+                if (!quiet) {
+                    (0, notify_1.notifyOs)({
+                        title: 'FullCourtDefense: machine suspended',
+                        message: 'An admin suspended this machine. AI tool calls are denied until it is resumed.',
+                        url: (0, notify_1.consoleUrl)('/agent-security/users?view=desktop'),
+                    });
+                }
+            }
+            else if (!bundle.suspended && suspended) {
+                suspended = false;
+                log('Machine resumed — normal enforcement restored.');
+            }
+        }
+        catch { /* offline — cached stance applies */ }
+    };
+    const heartbeat = async () => {
+        if (!creds.shieldId)
+            return;
+        try {
+            const result = await (0, telemetry_1.flushSpool)({
+                apiUrl: creds.apiUrl,
+                shieldId: creds.shieldId,
+                shieldKey: creds.shieldKey,
+                heartbeat: true,
+            });
+            if (result && result.accepted > 0)
+                log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
+        }
+        catch { /* spool stays on disk for the next tick */ }
+    };
+    // --- boot ---------------------------------------------------------------
+    const watched = refreshWatchTargets();
+    log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
+    await pollBundle();
+    await heartbeat();
+    // One protective pass at startup so a machine that drifted while the daemon
+    // was down converges immediately.
+    await reprotect(['startup pass']);
+    const rescanTimer = setInterval(() => {
+        const count = refreshWatchTargets();
+        log(`Rescan: watching ${count} config file(s).`);
+    }, RESCAN_INTERVAL_MS);
+    const bundleTimer = setInterval(() => { void pollBundle(); }, BUNDLE_POLL_MS);
+    const heartbeatTimer = setInterval(() => { void heartbeat(); }, HEARTBEAT_INTERVAL_MS);
+    const shutdown = (signal) => {
+        if (stopped)
+            return;
+        stopped = true;
+        log(`Received ${signal} — shutting down.`);
+        clearInterval(rescanTimer);
+        clearInterval(bundleTimer);
+        clearInterval(heartbeatTimer);
+        if (debounceTimer)
+            clearTimeout(debounceTimer);
+        for (const watcher of watchers.values())
+            watcher.close();
+        releasePidLock();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => shutdown('SIGINT'));
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    console.log(`\n${COLOR.green}${COLOR.bold}Daemon running.${COLOR.reset} ${COLOR.gray}Log: ${logFile()}  ·  Stop with Ctrl+C${COLOR.reset}\n`);
+    // Keep the process alive forever (timers alone would do it, but be explicit).
+    await new Promise(() => { });
+}
+// ---------------------------------------------------------------------------
+// Autostart install / uninstall / status
+// ---------------------------------------------------------------------------
+/** Hidden VBS launcher so the logon task doesn't flash a console window. */
+function ensureWindowsLauncher() {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const dir = path.join(base, 'FullCourtDefense');
+    fs.mkdirSync(dir, { recursive: true });
+    const vbs = path.join(dir, 'daemon.vbs');
+    const inner = `"${process.execPath}" "${cliEntry()}" daemon`;
+    const content = `CreateObject("WScript.Shell").Run "cmd /c ${inner.replace(/"/g, '""')}", 0, False\n`;
+    fs.writeFileSync(vbs, content, 'utf8');
+    return vbs;
+}
+function installWindows() {
+    const vbs = ensureWindowsLauncher();
+    const result = (0, child_process_1.spawnSync)('schtasks', [
+        '/Create', '/TN', TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
+        '/SC', 'ONLOGON', '/F', '/RL', 'LIMITED',
+    ], { stdio: 'inherit' });
+    return result.status === 0;
+}
+function uninstallWindows() {
+    const result = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'inherit' });
+    const vbs = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense', 'daemon.vbs');
+    try {
+        if (fs.existsSync(vbs))
+            fs.unlinkSync(vbs);
+    }
+    catch { /* ignore */ }
+    return result.status === 0;
+}
+function launchdPlistPath() {
+    return path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
+}
+function installMacos() {
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${process.execPath}</string>
+    <string>${cliEntry()}</string>
+    <string>daemon</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${logFile()}</string>
+  <key>StandardErrorPath</key><string>${logFile()}</string>
+</dict>
+</plist>
+`;
+    const file = launchdPlistPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, plist, 'utf8');
+    (0, child_process_1.spawnSync)('launchctl', ['unload', file], { stdio: 'ignore' });
+    const result = (0, child_process_1.spawnSync)('launchctl', ['load', file], { stdio: 'inherit' });
+    return result.status === 0;
+}
+function uninstallMacos() {
+    const file = launchdPlistPath();
+    const result = (0, child_process_1.spawnSync)('launchctl', ['unload', file], { stdio: 'inherit' });
+    try {
+        if (fs.existsSync(file))
+            fs.unlinkSync(file);
+    }
+    catch { /* ignore */ }
+    return result.status === 0;
+}
+function systemdUnitPath() {
+    const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    return path.join(base, 'systemd', 'user', SYSTEMD_UNIT);
+}
+function installLinux() {
+    const unit = `[Unit]
+Description=FullCourtDefense resident daemon (config watch + heartbeat)
+
+[Service]
+ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target
+`;
+    const file = systemdUnitPath();
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, unit, 'utf8');
+        const reload = (0, child_process_1.spawnSync)('systemctl', ['--user', 'daemon-reload'], { stdio: 'inherit' });
+        const enable = (0, child_process_1.spawnSync)('systemctl', ['--user', 'enable', '--now', SYSTEMD_UNIT], { stdio: 'inherit' });
+        if (reload.status === 0 && enable.status === 0)
+            return true;
+    }
+    catch { /* fall back to cron */ }
+    // Fallback: cron @reboot for boxes without a systemd user session.
+    const command = `"${process.execPath}" "${cliEntry()}" daemon >/dev/null 2>&1`;
+    const list = (0, child_process_1.spawnSync)('crontab', ['-l'], { encoding: 'utf8' });
+    const existing = (list.status === 0 ? (list.stdout || '') : '').split('\n').filter(l => l && !l.includes(CRON_MARKER));
+    const write = (0, child_process_1.spawnSync)('crontab', ['-'], { input: [...existing, `@reboot ${command} ${CRON_MARKER}`].join('\n') + '\n', encoding: 'utf8' });
+    return write.status === 0;
+}
+function uninstallLinux() {
+    let ok = false;
+    const file = systemdUnitPath();
+    if (fs.existsSync(file)) {
+        (0, child_process_1.spawnSync)('systemctl', ['--user', 'disable', '--now', SYSTEMD_UNIT], { stdio: 'inherit' });
+        try {
+            fs.unlinkSync(file);
+            ok = true;
+        }
+        catch { /* ignore */ }
+        (0, child_process_1.spawnSync)('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
+    }
+    const list = (0, child_process_1.spawnSync)('crontab', ['-l'], { encoding: 'utf8' });
+    if (list.status === 0) {
+        const existing = (list.stdout || '').split('\n').filter(l => l && !l.includes(CRON_MARKER));
+        const write = (0, child_process_1.spawnSync)('crontab', ['-'], { input: existing.join('\n') + '\n', encoding: 'utf8' });
+        ok = ok || write.status === 0;
+    }
+    return ok;
+}
+function statusCommand() {
+    console.log(`\n${COLOR.bold}${COLOR.cyan}FullCourtDefense daemon status${COLOR.reset}\n`);
+    let running = false;
+    try {
+        const pid = Number(fs.readFileSync(pidFile(), 'utf8').trim());
+        running = Number.isFinite(pid) && pid > 0 && isPidAlive(pid);
+        console.log(running
+            ? `${COLOR.green}Running${COLOR.reset} (pid ${pid})`
+            : `${COLOR.yellow}Not running${COLOR.reset} (stale pid file: ${pidFile()})`);
+    }
+    catch {
+        console.log(`${COLOR.yellow}Not running${COLOR.reset} (no pid file)`);
+    }
+    console.log(`${COLOR.gray}Log:${COLOR.reset} ${logFile()}`);
+    console.log(`${COLOR.gray}Autostart:${COLOR.reset}`);
+    if (process.platform === 'win32') {
+        (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'inherit' });
+    }
+    else if (process.platform === 'darwin') {
+        console.log(fs.existsSync(launchdPlistPath()) ? `  launchd agent installed (${launchdPlistPath()})` : '  not installed');
+    }
+    else {
+        console.log(fs.existsSync(systemdUnitPath()) ? `  systemd user unit installed (${systemdUnitPath()})` : '  not installed (check crontab -l for @reboot entry)');
+    }
+}
+async function daemonCommand(args, config) {
+    if (args.status === 'true') {
+        statusCommand();
+        return;
+    }
+    if (args.uninstall === 'true') {
+        const ok = process.platform === 'win32' ? uninstallWindows()
+            : process.platform === 'darwin' ? uninstallMacos()
+                : uninstallLinux();
+        console.log(ok
+            ? `${COLOR.green}Removed the FullCourtDefense daemon autostart.${COLOR.reset}`
+            : `${COLOR.yellow}No daemon autostart found (or removal failed).${COLOR.reset}`);
+        return;
+    }
+    if (args.install === 'true') {
+        console.log(`\n${COLOR.bold}${COLOR.cyan}FullCourtDefense — install resident daemon${COLOR.reset}`);
+        console.log(`${COLOR.gray}Watches MCP/hook configs and re-protects instantly on drift; heartbeats and flushes telemetry while the machine is idle.${COLOR.reset}\n`);
+        const ok = process.platform === 'win32' ? installWindows()
+            : process.platform === 'darwin' ? installMacos()
+                : installLinux();
+        if (ok) {
+            console.log(`${COLOR.green}${COLOR.bold}Daemon autostart installed.${COLOR.reset}`);
+            console.log(`${COLOR.gray}Trigger:${COLOR.reset} ${process.platform === 'win32' ? `at logon (Scheduled Task "${TASK_NAME}")` : process.platform === 'darwin' ? 'launchd (RunAtLoad + KeepAlive)' : 'systemd user unit (or @reboot cron)'}`);
+            console.log(`${COLOR.gray}Start now:${COLOR.reset} fullcourtdefense daemon`);
+            console.log(`${COLOR.gray}Status:${COLOR.reset} fullcourtdefense daemon --status true`);
+            console.log(`${COLOR.gray}Remove:${COLOR.reset} fullcourtdefense daemon --uninstall true`);
+            console.log(`${COLOR.gray}Note:${COLOR.reset} the daemon supersedes the scheduled auto-protect task — you can remove it with: fullcourtdefense auto-protect --uninstall true`);
+        }
+        else {
+            console.log(`${COLOR.red}Could not register the daemon autostart.${COLOR.reset} On Windows, retry from an elevated terminal if the task creation was denied.`);
+        }
+        return;
+    }
+    await runDaemon(args, config);
+}

package/dist/commands/discover.js

@@ -867,19 +867,6 @@ async function discoverCommand(args, config) {
         })
         : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
-    if (args.json === 'true') {
-        console.log(JSON.stringify({
-            host,
-            surfaces: [...surfaces],
-            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
-            clientCoverage,
-            servers: found,
-            secrets,
-            agentFiles,
-            posture,
-        }, null, 2));
-        return;
-    }
     const home = os.homedir();
     const uploadExtras = {
         secrets,
@@ -919,6 +906,20 @@ async function discoverCommand(args, config) {
         }
         await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
+    if (args.json === 'true') {
+        await maybeUpload();
+        console.log(JSON.stringify({
+            host,
+            surfaces: [...surfaces],
+            scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
+            clientCoverage,
+            servers: found,
+            secrets,
+            agentFiles,
+            posture,
+        }, null, 2));
+        return;
+    }
     if (silent) {
         if (uploadRequested) {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });

package/dist/commands/discoverSchedule.d.ts

@@ -7,4 +7,6 @@ export interface ScheduleArgs {
     trigger?: 'daily' | 'logon';
 }
 export declare function installDailyDiscoverSchedule(args?: ScheduleArgs): void;
+/** Whether the recurring discovery run is registered on this machine (any trigger). */
+export declare function isDiscoverScheduleInstalled(): boolean;
 export declare function uninstallDailyDiscoverSchedule(): void;

package/dist/commands/discoverSchedule.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.installDailyDiscoverSchedule = installDailyDiscoverSchedule;
+exports.isDiscoverScheduleInstalled = isDiscoverScheduleInstalled;
 exports.uninstallDailyDiscoverSchedule = uninstallDailyDiscoverSchedule;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -136,6 +137,27 @@ function installDailyDiscoverSchedule(args = {}) {
     else
         installLinuxCron(hour, args, trigger);
 }
+/** Whether the recurring discovery run is registered on this machine (any trigger). */
+function isDiscoverScheduleInstalled() {
+    if (process.platform === 'win32') {
+        try {
+            (0, child_process_1.execSync)(`schtasks /Query /TN "${TASK_NAME}"`, { stdio: 'ignore' });
+            return true;
+        }
+        catch { /* task not found */ }
+        return fs.existsSync(windowsStartupLauncherPath());
+    }
+    if (process.platform === 'darwin') {
+        return fs.existsSync(path.join(os.homedir(), 'Library', 'LaunchAgents', 'ai.fullcourtdefense.discover.plist'));
+    }
+    try {
+        const crontab = (0, child_process_1.execSync)('crontab -l', { encoding: 'utf8' });
+        return crontab.includes('fullcourtdefense-discover') || crontab.includes('discover --upload --deep --silent');
+    }
+    catch {
+        return false;
+    }
+}
 function uninstallDailyDiscoverSchedule() {
     if (process.platform === 'win32') {
         try {