fullcourtdefense-cli 1.14.9 → 1.14.11

package/dist/commands/discover.js

@@ -739,7 +739,8 @@ function printPostureReport(posture, silent) {
 async function discoverCommand(args, config) {
     const surfaces = parseSurfaces(args);
     const silent = args.silent === 'true';
-    const deep = args.deep === 'true';
+    const uploadRequested = args.upload === 'true';
+    const deep = args.deep === 'false' ? false : (args.deep === 'true' || uploadRequested);
     if (args.unschedule === 'true') {
         (0, discoverSchedule_1.uninstallDailyDiscoverSchedule)();
         if (!silent)
@@ -757,7 +758,7 @@ async function discoverCommand(args, config) {
         });
         if (!silent) {
             const when = args.schedule === 'logon' ? 'at logon' : `daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00`;
-            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --deep --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
             console.log('Uses login Shield credentials or an explicit org API key.');
         }
         return;
@@ -837,7 +838,7 @@ async function discoverCommand(args, config) {
         },
     };
     async function maybeUpload() {
-        if (args.upload !== 'true')
+        if (!uploadRequested)
             return;
         const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
         // Either an org API key OR an enrolled Shield key (from `login`) is enough.
@@ -851,7 +852,7 @@ async function discoverCommand(args, config) {
         await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
     if (silent) {
-        if (args.upload === 'true') {
+        if (uploadRequested) {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
             if (!creds.apiKey && !(creds.shieldId && creds.shieldKey))
                 process.exit(1);
@@ -903,14 +904,14 @@ async function discoverCommand(args, config) {
         printAgentFilesReport(agentFiles, silent);
     if (posture)
         printPostureReport(posture, silent);
-    if (args.upload === 'true') {
+    if (uploadRequested) {
         console.log('');
         await maybeUpload();
     }
     else {
         console.log(`${COLOR.gray}Run with --upload to push results into AI Fleet.${COLOR.reset}`);
         if (runMcp && !deep)
-            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE MCP servers.${COLOR.reset}`);
+            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE/stdio MCP servers.${COLOR.reset}`);
         if (!surfaces.has('secrets'))
             console.log(`${COLOR.gray}Add --surface secrets for .env / credential store scan (local-only).${COLOR.reset}`);
         if (surfaces.size < 4)

package/dist/commands/discoverSchedule.js

@@ -49,7 +49,7 @@ function discoverCommandLine(userEmail, surface) {
     const node = process.execPath;
     const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
-    const parts = [q(node), q(script), 'discover', '--upload', '--silent'];
+    const parts = [q(node), q(script), 'discover', '--upload', '--deep', '--silent'];
     if (surface)
         parts.push('--surface', q(surface));
     if (userEmail)

package/dist/commands/mcpGateway.js

@@ -967,7 +967,7 @@ function clientInstallArgs(args) {
     };
 }
 async function installCursorMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'cursor',
         agentNamePrefix: 'cursor',
         userObjective: 'Developer requested this action from Cursor.',
@@ -976,6 +976,7 @@ async function installCursorMcpGatewayCommand(args, config) {
     const file = cursorMcpPath(projectScope);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1141,6 +1142,24 @@ function backupFile(file) {
 function perServerAgentName(developerName, _agentClient, serverName) {
     return `${safeIdentityPart(developerName)}-${safeIdentityPart(serverName)}`;
 }
+/**
+ * Per-server installs (`install-*-mcp-gateway --server-name foo`) must report the SAME
+ * runtime-agnostic agent identity that protect-all/auto-protect produce (`<developer>-<server>`).
+ * Otherwise the gateway reports a generic `<developer>-<client>` name and a dashboard policy
+ * targeting the MCP server (agentName contains <server>) silently never matches — the exact
+ * bug where a block policy on `patria-bank-finance` did not fire because the Claude Desktop
+ * entry reported `boazl-claude-desktop`. An explicit --agent-name / FCD_AGENT_NAME still wins.
+ */
+function applyPerServerAgentName(gatewayConfig, args, serverName) {
+    if (args.agentName || process.env.FCD_AGENT_NAME)
+        return gatewayConfig;
+    if (!serverName || serverName === MANAGED_SERVER_NAME)
+        return gatewayConfig;
+    return {
+        ...gatewayConfig,
+        agentName: perServerAgentName(gatewayConfig.developerName, gatewayConfig.agentClient, serverName),
+    };
+}
 function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
     const stats = newWrapStats();
     let json;
@@ -1495,7 +1514,7 @@ async function unprotectAllCommand(args, config) {
     console.log(`\n${dryRun ? 'Would restore' : 'Restored'} ${total} server(s) to their original commands. Restart each client.`);
 }
 async function installClaudeCodeMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-code',
         agentNamePrefix: 'claude-code',
         userObjective: 'Developer requested this action from Claude Code.',
@@ -1503,6 +1522,7 @@ async function installClaudeCodeMcpGatewayCommand(args, config) {
     const scope = normalizeClaudeCodeScope(args.scope);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1555,7 +1575,7 @@ async function installClaudeCodeMcpGatewayCommand(args, config) {
     throw new Error('Claude Code CLI was not available. Install Claude Code or rerun with --scope project to write .mcp.json directly.');
 }
 async function installClaudeDesktopMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-desktop',
         agentNamePrefix: 'claude-desktop',
         userObjective: 'Developer requested this action from Claude Desktop.',
@@ -1563,6 +1583,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
     const targets = (0, discoverPaths_1.claudeDesktopInstallTargets)(args.configPath);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1580,7 +1601,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
     console.log('Restart Claude Desktop to load the protected tools.');
 }
 async function installCodexMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'codex',
         agentNamePrefix: 'codex',
         userObjective: 'Developer requested this action from Codex.',
@@ -1589,6 +1610,7 @@ async function installCodexMcpGatewayCommand(args, config) {
     const file = codexConfigPath(projectScope);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1601,7 +1623,7 @@ async function installCodexMcpGatewayCommand(args, config) {
     console.log('Restart Codex or reload MCP servers. Project config requires a trusted project.');
 }
 async function installGeminiMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'gemini-cli',
         agentNamePrefix: 'gemini',
         userObjective: 'Developer requested this action from Gemini CLI.',
@@ -1610,6 +1632,7 @@ async function installGeminiMcpGatewayCommand(args, config) {
     const file = geminiSettingsPath(projectScope);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1622,7 +1645,7 @@ async function installGeminiMcpGatewayCommand(args, config) {
     console.log('Restart Gemini CLI to load the protected tools.');
 }
 async function installWindsurfMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'windsurf',
         agentNamePrefix: 'windsurf',
         userObjective: 'Developer requested this action from Windsurf.',
@@ -1630,6 +1653,7 @@ async function installWindsurfMcpGatewayCommand(args, config) {
     const file = windsurfConfigPath();
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
@@ -1642,7 +1666,7 @@ async function installWindsurfMcpGatewayCommand(args, config) {
     console.log('Restart Windsurf to load the protected tools.');
 }
 async function installVscodeMcpGatewayCommand(args, config) {
-    const gatewayConfig = resolveGatewayConfig(args, config, {
+    const baseGatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'vscode',
         agentNamePrefix: 'vscode',
         userObjective: 'Developer requested this action from VS Code.',
@@ -1650,6 +1674,7 @@ async function installVscodeMcpGatewayCommand(args, config) {
     const projectScope = args.project !== 'false';
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const gatewayConfig = applyPerServerAgentName(baseGatewayConfig, args, serverName);
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.9"
+  "version": "1.14.11"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.9",
+  "version": "1.14.11",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {