fullcourtdefense-cli 1.15.0 → 1.15.1

package/README.md

@@ -26,6 +26,20 @@ fullcourtdefense onboard --token <fleet-enrollment-token>
 
 Then restart your AI clients (Cursor, Claude, VS Code, ...) so they pick up the wrapped configs. The machine reports to your org's AI Fleet in monitor-first mode until an admin enables enforcement.
 
+Onboarding is a resumable local transaction. Its non-secret status journal is
+stored at `~/.fullcourtdefense/onboarding.json`; use `--resume` after an
+interruption and `--repair` to re-run completed protection installation steps.
+Discovery upload and its daily schedule are recorded as optional telemetry,
+separate from required protection. Useful MDM options:
+
+```bash
+fullcourtdefense onboard --dry-run true --json true # preflight + final JSON status
+fullcourtdefense onboard --resume                   # continue a failed transaction
+fullcourtdefense onboard --resume --repair          # reinstall protection surfaces
+fullcourtdefense onboard --schedule false           # do not install daily discovery
+fullcourtdefense onboard --no-daemon true           # do not enable optional self-healing
+```
+
 Manual step-by-step equivalent:
 
 ```bash
@@ -57,7 +71,7 @@ fullcourtdefense init
 ## Command Guide
 
 - `fullcourtdefense help` — shows the full onboarding flow and command reference.
-- `fullcourtdefense onboard --token <token>` — one command: doctor + login + install-all + verification checklist (exits non-zero if a required surface failed — safe for MDM scripts).
+- `fullcourtdefense onboard --token <token>` — resumable machine transaction: preflight + login + protection + optional discovery + verification. `--json true` prints final machine-readable status; exits non-zero only when a critical step fails.
 - `fullcourtdefense doctor` — confirms outbound HTTPS to FullCourtDefense is open before scanning.
 - `fullcourtdefense login --token <token>` — enrolls this machine with a fleet token and saves per-machine Shield credentials (no copy/paste).
 - `fullcourtdefense install-all` — wraps every configured MCP server, installs IDE hooks and terminal guards, uploads discovery, schedules daily rescans.

package/dist/commands/daemon.d.ts

@@ -7,4 +7,6 @@ export interface DaemonArgs extends ProtectAllArgs {
     /** Suppress OS toasts (still logs). */
     quiet?: string;
 }
+/** Whether the daemon has been registered to start automatically. */
+export declare function isDaemonAutostartInstalled(): boolean;
 export declare function daemonCommand(args: DaemonArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/daemon.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDaemonAutostartInstalled = isDaemonAutostartInstalled;
 exports.daemonCommand = daemonCommand;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -43,6 +44,7 @@ const mcpGateway_1 = require("./mcpGateway");
 const runtimeConfig_1 = require("../runtimeConfig");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
+const integrity_1 = require("../integrity");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -266,14 +268,20 @@ async function runDaemon(args, config) {
         if (!creds.shieldId)
             return;
         try {
+            const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
             const result = await (0, telemetry_1.flushSpool)({
                 apiUrl: creds.apiUrl,
                 shieldId: creds.shieldId,
                 shieldKey: creds.shieldKey,
                 heartbeat: true,
+                integrityOk: integrity.ok,
+                integrityReasons: integrity.reasons,
+                integrityCheckedAt: integrity.checkedAt,
             });
             if (result && result.accepted > 0)
                 log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
+            if (!integrity.ok)
+                log(`Integrity warning: ${integrity.reasons.join(', ')}.`);
         }
         catch { /* spool stays on disk for the next tick */ }
     };
@@ -387,6 +395,20 @@ function systemdUnitPath() {
     const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
     return path.join(base, 'systemd', 'user', SYSTEMD_UNIT);
 }
+/** Whether the daemon has been registered to start automatically. */
+function isDaemonAutostartInstalled() {
+    if (process.platform === 'win32') {
+        const result = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], {
+            stdio: 'ignore',
+            timeout: 5_000,
+            windowsHide: true,
+        });
+        return result.status === 0;
+    }
+    if (process.platform === 'darwin')
+        return fs.existsSync(launchdPlistPath());
+    return fs.existsSync(systemdUnitPath());
+}
 function installLinux() {
     const unit = `[Unit]
 Description=FullCourtDefense resident daemon (config watch + heartbeat)

package/dist/commands/onboard.d.ts

@@ -3,6 +3,16 @@ import { InstallAllArgs } from './installAll';
 export interface OnboardArgs extends InstallAllArgs {
     /** Fleet enrollment token (or FCD_ENROLL_TOKEN env). Optional when already enrolled. */
     token?: string;
+    /** Continue a persisted onboarding transaction. */
+    resume?: string;
+    /** Re-run completed install steps to repair changed machine state. */
+    repair?: string;
+    /** Report the transaction plan without changing local configuration. */
+    dryRun?: string;
+    /** Print the final transaction status as JSON. */
+    json?: string;
+    /** Do not enable optional self-healing protection. */
+    noDaemon?: string;
 }
 /**
  * `fullcourtdefense onboard` — the one-command path from a fresh machine to a

package/dist/commands/onboard.js

@@ -40,6 +40,7 @@ const path = __importStar(require("path"));
 const config_1 = require("../config");
 const login_1 = require("./login");
 const installAll_1 = require("./installAll");
+const discover_1 = require("./discover");
 const discoverPaths_1 = require("./discoverPaths");
 const discoverSchedule_1 = require("./discoverSchedule");
 const windowsAudit_1 = require("./windowsAudit");
@@ -47,6 +48,9 @@ const shellGuard_1 = require("./shellGuard");
 const cmdGuard_1 = require("./cmdGuard");
 const posixShellGuard_1 = require("./posixShellGuard");
 const notify_1 = require("../notify");
+const daemon_1 = require("./daemon");
+const machineIdentity_1 = require("../machineIdentity");
+const onboardingJournal_1 = require("./onboardingJournal");
 const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
 const YELLOW = '\x1b[33m';
@@ -70,6 +74,41 @@ async function checkBackendReachable(apiUrl) {
         return { label: 'Backend reachable', ok: false, detail: error instanceof Error ? error.message : String(error) };
     }
 }
+async function checkEnrollmentCredential(apiUrl, token) {
+    try {
+        const identity = (0, machineIdentity_1.getMachineIdentity)();
+        const resp = await fetch(`${apiUrl}/api/cli/enroll/preflight`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-fleet-token': token },
+            body: JSON.stringify({
+                machineId: identity.machineId,
+                hostname: identity.hostname,
+                developerName: identity.developerName,
+                platform: identity.platform,
+                osFriendly: identity.osFriendly,
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        const body = await resp.json().catch(() => ({}));
+        if (resp.ok && body.success) {
+            const status = body.data?.enrollmentStatus === 'already_enrolled' ? 'existing device can be re-enrolled safely' : 'new device is eligible';
+            return { label: 'Enrollment credential', ok: true, detail: status };
+        }
+        return { label: 'Enrollment credential', ok: false, detail: body.error || `HTTP ${resp.status}` };
+    }
+    catch (error) {
+        return { label: 'Enrollment credential', ok: false, detail: error instanceof Error ? error.message : String(error) };
+    }
+}
+function checkCompatibility() {
+    const nodeMajor = Number.parseInt(process.versions.node.split('.')[0] || '0', 10);
+    const supportedPlatform = ['win32', 'darwin', 'linux'].includes(process.platform);
+    if (nodeMajor < 18)
+        return { label: 'CLI compatibility', ok: false, detail: `Node.js ${process.versions.node}; Node 18+ is required` };
+    if (!supportedPlatform)
+        return { label: 'CLI compatibility', ok: false, detail: `${process.platform} is not supported for local protection` };
+    return { label: 'CLI compatibility', ok: true, detail: `Node ${process.versions.node} on ${process.platform}` };
+}
 function readTextSafe(file) {
     try {
         return fs.readFileSync(file, 'utf8');
@@ -154,40 +193,161 @@ function checkTerminalGuards() {
  * Exits non-zero when a required surface failed, so MDM scripts can gate on it.
  */
 async function onboardCommand(args, config) {
+    const journal = (0, onboardingJournal_1.loadOnboardingJournal)();
+    const dryRun = args.dryRun === 'true';
+    const repair = args.repair === 'true';
+    const json = args.json === 'true';
+    const journalFile = (0, onboardingJournal_1.onboardingJournalPath)();
+    const persist = () => (0, onboardingJournal_1.saveOnboardingJournal)(journal, journalFile);
+    const mark = (name, status, detail, error) => {
+        (0, onboardingJournal_1.updateOnboardingStep)(journal, name, status, detail, error);
+        persist();
+    };
+    const report = (nextAction) => {
+        journal.nextAction = nextAction;
+        persist();
+        if (json)
+            console.log(JSON.stringify({ ok: !Object.values(journal.steps).some(step => step.critical && step.status === 'failed'), journalPath: journalFile, ...journal }));
+    };
     console.log(`\n${BOLD}\x1b[36mFullCourtDefense — machine onboarding${RESET}`);
     console.log(`${DIM}Connectivity -> enrollment -> protection -> verification. One command.${RESET}\n`);
     const creds = (0, config_1.resolveCliCredentials)(config, { apiUrl: args.apiUrl });
     const apiUrl = creds.apiUrl;
+    const token = (args.token || process.env.FCD_ENROLL_TOKEN || '').trim();
     // 1. Connectivity.
-    console.log(`${BOLD}[1/4] Checking connectivity…${RESET}`);
+    console.log(`${BOLD}[1/6] Checking compatibility and connectivity…${RESET}`);
+    mark('preflight', 'running');
     const reachable = await checkBackendReachable(apiUrl);
+    const compatible = checkCompatibility();
+    printCheck(compatible);
     printCheck(reachable);
-    if (!reachable.ok) {
-        console.log(`\n${RED}Cannot reach the FullCourtDefense backend.${RESET} Allow outbound TCP 443 to ${apiUrl}, check proxy settings, then re-run.`);
-        process.exit(1);
+    if (!reachable.ok || !compatible.ok) {
+        const detail = !reachable.ok ? reachable.detail : compatible.detail;
+        mark('preflight', 'failed', undefined, detail);
+        report(!reachable.ok
+            ? `Restore connectivity to ${apiUrl}, then run fullcourtdefense onboard --resume.`
+            : 'Install Node.js 18 or later, then run fullcourtdefense onboard --resume.');
+        process.exitCode = 1;
+        return;
+    }
+    if (token) {
+        const enrollmentCredential = await checkEnrollmentCredential(apiUrl, token);
+        printCheck(enrollmentCredential);
+        if (!enrollmentCredential.ok) {
+            mark('preflight', 'failed', undefined, enrollmentCredential.detail);
+            report('Request a valid enrollment code from your administrator, then run fullcourtdefense onboard --resume.');
+            process.exitCode = 1;
+            return;
+        }
     }
+    mark('preflight', 'completed');
     // 2. Enrollment.
-    console.log(`\n${BOLD}[2/4] Enrolling this machine…${RESET}`);
-    const token = (args.token || process.env.FCD_ENROLL_TOKEN || '').trim();
+    console.log(`\n${BOLD}[2/6] Enrolling this machine…${RESET}`);
+    mark('enrollment', 'running');
     const alreadyEnrolled = Boolean(creds.shieldId && creds.shieldKey);
-    if (token) {
+    if (dryRun) {
+        mark('enrollment', 'skipped', alreadyEnrolled ? 'would reuse existing per-machine Shield credentials' : 'would enroll with supplied token');
+    }
+    else if (token) {
         await (0, login_1.loginCommand)({ token, apiUrl: args.apiUrl }, config);
+        mark('enrollment', 'completed', 'machine enrolled');
     }
     else if (alreadyEnrolled) {
         console.log(`  ${GREEN}✓${RESET} Already enrolled ${DIM}(shield ${creds.shieldId})${RESET} — pass --token to re-enroll.`);
+        mark('enrollment', 'completed', `reused shield ${creds.shieldId}`);
     }
     else {
         console.log(`\n${RED}No fleet enrollment token.${RESET} Ask an org admin for one (AI Fleet -> Settings -> Fleet enrollment token), then run:`);
         console.log(`  ${BOLD}fullcourtdefense onboard --token <fleet-enrollment-token>${RESET}`);
-        process.exit(1);
+        mark('enrollment', 'failed', undefined, 'no fleet enrollment token or saved machine credentials');
+        report('Get a fleet enrollment token, then run fullcourtdefense onboard --resume --token <token>.');
+        process.exitCode = 1;
+        return;
     }
     // Re-read config: login just wrote fresh shield credentials to ~/.fullcourtdefense.yml.
     const freshConfig = (0, config_1.loadConfig)();
     // 3. Protection.
-    console.log(`\n${BOLD}[3/4] Installing protection (install-all)…${RESET}`);
-    await (0, installAll_1.installAllCommand)({ ...args, apiUrl }, freshConfig);
+    console.log(`\n${BOLD}[3/6] Installing protection (install-all)…${RESET}`);
+    if (dryRun) {
+        mark('protection', 'skipped', 'would install MCP gateways, IDE hooks, and terminal guards');
+    }
+    else if (journal.steps.protection.status === 'completed' && !repair) {
+        console.log(`  ${GREEN}✓${RESET} Reusing completed protection step ${DIM}(use --repair to reinstall)${RESET}`);
+    }
+    else {
+        mark('protection', 'running');
+        try {
+            // Discovery and scheduling are deliberately separate optional transaction
+            // steps. install-all remains the compatibility-preserving protection owner.
+            await (0, installAll_1.installAllCommand)({
+                ...args,
+                apiUrl,
+                discover: 'false',
+                schedule: 'false',
+                autoProtect: args.noDaemon === 'true' ? 'false' : args.autoProtect,
+            }, freshConfig);
+            mark('protection', 'completed');
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            mark('protection', 'failed', undefined, detail);
+            report('Fix the protection error, then run fullcourtdefense onboard --resume --repair.');
+            process.exitCode = 1;
+            return;
+        }
+    }
+    console.log(`\n${BOLD}[4/6] Installing background protection…${RESET}`);
+    if (dryRun || args.noDaemon === 'true') {
+        mark('daemon', 'skipped', dryRun ? 'would register the resident daemon' : 'disabled by --no-daemon true');
+    }
+    else {
+        mark('daemon', 'running');
+        try {
+            await (0, daemon_1.daemonCommand)({ ...args, install: 'true', quiet: 'true' }, freshConfig);
+            if ((0, daemon_1.isDaemonAutostartInstalled)()) {
+                mark('daemon', 'completed', 'resident daemon autostart registered');
+            }
+            else {
+                mark('daemon', 'failed', undefined, 'daemon autostart was not registered; run an elevated terminal and retry `fullcourtdefense daemon --install true`');
+            }
+        }
+        catch (error) {
+            mark('daemon', 'failed', undefined, error instanceof Error ? error.message : String(error));
+        }
+    }
+    // Discovery and scheduling are useful fleet telemetry, but must never mark a
+    // device as unprotected or prevent a repair of the enforcement surfaces.
+    console.log(`\n${BOLD}[5/6] Recording optional discovery and schedule…${RESET}`);
+    if (dryRun || args.discover === 'false') {
+        mark('discovery', 'skipped', dryRun ? 'would upload desktop discovery' : 'disabled by --discover false');
+    }
+    else {
+        mark('discovery', 'running');
+        try {
+            await (0, discover_1.discoverCommand)({ surface: 'all', upload: 'true', apiUrl, userEmail: args.developerName }, freshConfig);
+            mark('discovery', 'completed');
+        }
+        catch (error) {
+            mark('discovery', 'failed', undefined, error instanceof Error ? error.message : String(error));
+        }
+    }
+    if (dryRun || args.schedule === 'false') {
+        mark('schedule', 'skipped', dryRun ? 'would install daily discovery schedule' : 'disabled by --schedule false');
+    }
+    else {
+        mark('schedule', 'running');
+        try {
+            const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
+            (0, discoverSchedule_1.installDailyDiscoverSchedule)({ userEmail: args.developerName, hour: Number.isFinite(hour) ? hour : 9, surface: 'all', trigger: 'daily' });
+            mark('schedule', 'completed');
+        }
+        catch (error) {
+            mark('schedule', 'failed', undefined, error instanceof Error ? error.message : String(error));
+        }
+    }
     // 4. Verification.
-    console.log(`\n${BOLD}[4/4] Verifying protection surfaces…${RESET}`);
+    console.log(`\n${BOLD}[6/6] Verifying protection surfaces…${RESET}`);
+    mark('verification', 'running');
     const postCreds = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(), { apiUrl });
     const checks = [
         reachable,
@@ -200,6 +360,12 @@ async function onboardCommand(args, config) {
         checkClaudeHooks(),
         checkMcpGateways(),
         ...checkTerminalGuards(),
+        {
+            label: 'Resident daemon autostart',
+            ok: (0, daemon_1.isDaemonAutostartInstalled)(),
+            optional: true,
+            detail: (0, daemon_1.isDaemonAutostartInstalled)() ? undefined : 'run fullcourtdefense daemon --install true from an elevated terminal',
+        },
         {
             label: 'Daily discovery schedule',
             ok: (0, discoverSchedule_1.isDiscoverScheduleInstalled)(),
@@ -217,9 +383,13 @@ async function onboardCommand(args, config) {
         console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet (monitor-first until an admin enables enforcement).`);
         console.log(`${DIM}Fleet view: ${dashboard}${RESET}`);
         console.log(`${DIM}Restart your AI clients (Cursor, Claude, VS Code, …) so they pick up the wrapped configs.${RESET}`);
+        mark('verification', 'completed');
+        report('Onboarding complete. Restart AI clients to load protected configurations.');
     }
     else {
         console.log(`${YELLOW}${BOLD}Onboarding finished with ${requiredFailures.length} unresolved surface(s).${RESET} Fix the ✗ lines above and re-run ${BOLD}fullcourtdefense onboard${RESET}.`);
-        process.exit(1);
+        mark('verification', 'failed', undefined, `${requiredFailures.length} critical protection surfaces unresolved`);
+        report('Fix the failed required surfaces, then run fullcourtdefense onboard --resume --repair.');
+        process.exitCode = 1;
     }
 }

package/dist/commands/onboardingJournal.d.ts

@@ -0,0 +1,20 @@
+export type OnboardingStepName = 'preflight' | 'enrollment' | 'protection' | 'daemon' | 'discovery' | 'schedule' | 'verification';
+export type OnboardingStepStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped';
+export interface OnboardingStep {
+    status: OnboardingStepStatus;
+    critical: boolean;
+    updatedAt: string;
+    error?: string;
+    detail?: string;
+}
+export interface OnboardingJournal {
+    version: 1;
+    updatedAt: string;
+    nextAction: string;
+    steps: Record<OnboardingStepName, OnboardingStep>;
+}
+export declare function onboardingJournalPath(home?: string): string;
+export declare function createOnboardingJournal(): OnboardingJournal;
+export declare function loadOnboardingJournal(file?: string): OnboardingJournal;
+export declare function saveOnboardingJournal(journal: OnboardingJournal, file?: string): void;
+export declare function updateOnboardingStep(journal: OnboardingJournal, name: OnboardingStepName, status: OnboardingStepStatus, detail?: string, error?: string): void;

package/dist/commands/onboardingJournal.js

@@ -0,0 +1,100 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onboardingJournalPath = onboardingJournalPath;
+exports.createOnboardingJournal = createOnboardingJournal;
+exports.loadOnboardingJournal = loadOnboardingJournal;
+exports.saveOnboardingJournal = saveOnboardingJournal;
+exports.updateOnboardingStep = updateOnboardingStep;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const STEP_DEFINITIONS = [
+    ['preflight', true],
+    ['enrollment', true],
+    ['protection', true],
+    ['daemon', false],
+    ['discovery', false],
+    ['schedule', false],
+    ['verification', true],
+];
+function onboardingJournalPath(home = os.homedir()) {
+    return path.join(home, '.fullcourtdefense', 'onboarding.json');
+}
+function createOnboardingJournal() {
+    const now = new Date().toISOString();
+    return {
+        version: 1,
+        updatedAt: now,
+        nextAction: 'Run fullcourtdefense onboard --resume to begin.',
+        steps: Object.fromEntries(STEP_DEFINITIONS.map(([name, critical]) => [
+            name,
+            { status: 'pending', critical, updatedAt: now },
+        ])),
+    };
+}
+function loadOnboardingJournal(file = onboardingJournalPath()) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (parsed.version === 1 && parsed.steps) {
+            const fallback = createOnboardingJournal();
+            return {
+                ...fallback,
+                ...parsed,
+                steps: { ...fallback.steps, ...parsed.steps },
+            };
+        }
+    }
+    catch {
+        // A missing or malformed journal must never prevent repair.
+    }
+    return createOnboardingJournal();
+}
+function saveOnboardingJournal(journal, file = onboardingJournalPath()) {
+    journal.updatedAt = new Date().toISOString();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(journal, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    fs.renameSync(temporary, file);
+}
+function updateOnboardingStep(journal, name, status, detail, error) {
+    journal.steps[name] = {
+        ...journal.steps[name],
+        status,
+        updatedAt: new Date().toISOString(),
+        ...(detail ? { detail } : {}),
+        ...(error ? { error } : {}),
+    };
+}

package/dist/config.d.ts

@@ -4,6 +4,8 @@ export interface BotGuardConfig {
     apiUrl?: string;
     shieldId?: string;
     shieldKey?: string;
+    /** Windows DPAPI-protected shield key. Preferred over plaintext shieldKey. */
+    shieldKeyDpapi?: string;
     scan?: {
         endpoint?: string;
         description?: string;

package/dist/config.js

@@ -45,6 +45,7 @@ exports.resolveSystemPrompt = resolveSystemPrompt;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -137,6 +138,7 @@ function readConfigFile(filePath) {
         apiUrl: raw.apiUrl ? interpolateEnv(String(raw.apiUrl)) : undefined,
         shieldId: raw.shieldId ? interpolateEnv(String(raw.shieldId)) : undefined,
         shieldKey: raw.shieldKey ? interpolateEnv(String(raw.shieldKey)) : undefined,
+        shieldKeyDpapi: raw.shieldKeyDpapi ? String(raw.shieldKeyDpapi) : undefined,
         scan: raw.scan
             ? {
                 endpoint: raw.scan.endpoint,
@@ -152,6 +154,33 @@ function readConfigFile(filePath) {
             : undefined,
     };
 }
+function powershellDpapi(script, value) {
+    if (process.platform !== 'win32' || !value)
+        return undefined;
+    try {
+        return (0, child_process_1.execFileSync)('powershell.exe', [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy', 'Bypass',
+            '-Command', script,
+        ], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            env: { ...process.env, FCD_DPAPI_VALUE: value },
+            timeout: 5_000,
+            windowsHide: true,
+        }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function protectShieldKeyForCurrentWindowsUser(value) {
+    return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE -AsPlainText -Force; ConvertFrom-SecureString -SecureString $secure', value);
+}
+function unprotectShieldKeyForCurrentWindowsUser(value) {
+    return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; $ptr=[Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure); try {[Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)} finally {[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)}', value);
+}
 function mergeConfig(base, override) {
     return {
         ...base,
@@ -213,6 +242,7 @@ function resolveCliCredentials(config, overrides = {}) {
             || process.env.FULLCOURTDEFENSE_SHIELD_ID
             || process.env.AGENTGUARD_SHIELD_ID,
         shieldKey: overrides.shieldKey
+            || unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi || '')
             || config.shieldKey
             || process.env.FCD_SHIELD_KEY
             || process.env.FULLCOURTDEFENSE_SHIELD_KEY
@@ -266,8 +296,21 @@ function writeSetupConfig(target, input) {
     setTopLevel('apiKey', input.apiKey);
     setTopLevel('organizationId', input.organizationId);
     setTopLevel('shieldId', input.shieldId);
-    setTopLevel('shieldKey', input.shieldKey);
+    const protectedShieldKey = input.shieldKey && process.platform === 'win32'
+        ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)
+        : undefined;
+    if (protectedShieldKey) {
+        setTopLevel('shieldKeyDpapi', protectedShieldKey);
+        // Remove legacy plaintext key on a successful Windows DPAPI migration.
+        const plaintextIndex = lines.findIndex(line => /^shieldKey:/.test(line.trim()));
+        if (plaintextIndex >= 0)
+            lines.splice(plaintextIndex, 1);
+    }
+    else {
+        setTopLevel('shieldKey', input.shieldKey);
+    }
     setTopLevel('apiUrl', input.apiUrl);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, `${lines.filter((line, idx, arr) => !(line === '' && arr[idx - 1] === '')).join('\n').trim()}\n`, 'utf-8');
     return target;
 }

package/dist/index.js

@@ -359,6 +359,8 @@ function printHelp() {
     $ fullcourtdefense login --token <fleet-enrollment-token>
     $ fullcourtdefense install-all
     $ fullcourtdefense install-all --auto-protect true --upload
+    $ fullcourtdefense onboard --token <fleet-enrollment-token> --resume
+    $ fullcourtdefense onboard --dry-run true --json true
     $ fullcourtdefense discover --surface all --upload --schedule logon
     $ fullcourtdefense install-mcp-gateway --clients cursor,codex --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-codex-mcp-gateway --mcp-command npm --mcp-args "run mcp"
@@ -634,6 +636,8 @@ async function main() {
                 shellGuard: flags['shell-guard'],
                 cmdGuard: flags['cmd-guard'],
                 posixGuard: flags['posix-guard'],
+                schedule: flags.schedule,
+                scheduleHour: flags['schedule-hour'],
             };
             await (0, installAll_1.installAllCommand)(args, config);
             break;
@@ -650,6 +654,13 @@ async function main() {
                 shellGuard: flags['shell-guard'],
                 cmdGuard: flags['cmd-guard'],
                 posixGuard: flags['posix-guard'],
+                schedule: flags.schedule,
+                scheduleHour: flags['schedule-hour'],
+                resume: flags.resume,
+                repair: flags.repair,
+                dryRun: flags['dry-run'],
+                json: flags.json,
+                noDaemon: flags['no-daemon'],
             };
             await (0, onboard_1.onboardCommand)(args, config);
             break;

package/dist/integrity.d.ts

@@ -0,0 +1,21 @@
+export type IntegrityReason = 'mcp_gateway_missing' | 'cursor_hook_changed' | 'claude_hook_changed' | 'daemon_not_running' | 'runtime_bundle_stale';
+export interface LocalIntegrityReport {
+    ok: boolean;
+    reasons: IntegrityReason[];
+    checkedAt: string;
+    protectedMcpConfigs: number;
+    discoveredMcpConfigs: number;
+    daemonRunning: boolean;
+}
+export declare function isDaemonRunning(): boolean;
+/**
+ * Local-only verification of the protection surfaces that a user-mode agent can
+ * observe. It deliberately reports gaps instead of claiming EDR-grade tamper
+ * resistance: unsupported clients and non-interactive shells remain visible
+ * product limitations.
+ */
+export declare function getLocalIntegrityReport(options?: {
+    requireDaemon?: boolean;
+    runtimeBundleFetchedAt?: number;
+    runtimeBundleMaxAgeMs?: number;
+}): LocalIntegrityReport;

package/dist/integrity.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDaemonRunning = isDaemonRunning;
+exports.getLocalIntegrityReport = getLocalIntegrityReport;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const discoverPaths_1 = require("./commands/discoverPaths");
+function readText(file) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function hasMcpServers(text) {
+    return /"mcpServers"|\[mcp_servers\]|"servers"\s*:/.test(text)
+        && /"command"|command\s*=|"url"\s*:/.test(text);
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function isDaemonRunning() {
+    try {
+        const pid = Number(readText(path.join(os.homedir(), '.fullcourtdefense', 'daemon.pid')).trim());
+        return Number.isFinite(pid) && pid > 0 && isPidAlive(pid);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Local-only verification of the protection surfaces that a user-mode agent can
+ * observe. It deliberately reports gaps instead of claiming EDR-grade tamper
+ * resistance: unsupported clients and non-interactive shells remain visible
+ * product limitations.
+ */
+function getLocalIntegrityReport(options = {}) {
+    const reasons = [];
+    let discoveredMcpConfigs = 0;
+    let protectedMcpConfigs = 0;
+    for (const candidate of (0, discoverPaths_1.candidateConfigPaths)(process.cwd())) {
+        const text = readText(candidate.path);
+        if (!text || !hasMcpServers(text))
+            continue;
+        discoveredMcpConfigs++;
+        if (text.includes('mcp-gateway'))
+            protectedMcpConfigs++;
+    }
+    if (protectedMcpConfigs < discoveredMcpConfigs)
+        reasons.push('mcp_gateway_missing');
+    const home = os.homedir();
+    const cursorHooks = readText(path.join(home, '.cursor', 'hooks.json'));
+    if (cursorHooks && !(/fcd-managed|fullcourtdefense|botguard/i.test(cursorHooks))) {
+        reasons.push('cursor_hook_changed');
+    }
+    const claudeHooks = readText(path.join(home, '.claude', 'settings.json'));
+    if (claudeHooks && !(/fcd-managed|fullcourtdefense|botguard/i.test(claudeHooks))) {
+        reasons.push('claude_hook_changed');
+    }
+    const daemonRunning = isDaemonRunning();
+    if (options.requireDaemon && !daemonRunning)
+        reasons.push('daemon_not_running');
+    if (options.runtimeBundleFetchedAt && Date.now() - options.runtimeBundleFetchedAt > (options.runtimeBundleMaxAgeMs ?? 5 * 60_000)) {
+        reasons.push('runtime_bundle_stale');
+    }
+    return {
+        ok: reasons.length === 0,
+        reasons,
+        checkedAt: new Date().toISOString(),
+        protectedMcpConfigs,
+        discoveredMcpConfigs,
+        daemonRunning,
+    };
+}

package/dist/telemetry.d.ts

@@ -29,6 +29,9 @@ export interface FlushInput {
     agentVersion?: string;
     /** Whether protection points still look intact (tamper signal). */
     integrityOk?: boolean;
+    /** Machine-readable reasons for partial protection, never prompt/tool content. */
+    integrityReasons?: string[];
+    integrityCheckedAt?: string;
     timeoutMs?: number;
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */

package/dist/telemetry.js

@@ -138,6 +138,8 @@ async function flushSpool(input) {
                     ? {
                         agentVersion: input.agentVersion,
                         integrityOk: input.integrityOk,
+                        integrityReasons: input.integrityReasons,
+                        integrityCheckedAt: input.integrityCheckedAt,
                         coverage: 'hooks',
                         hostname: identity.hostname,
                         // Windows-only: current PowerShell audit coverage (ScriptBlock

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.0"
+  "version": "1.15.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -27,9 +27,13 @@
     "test:per-server-agent-name": "npm run build && node scripts/test-per-server-agent-name.js",
     "test:remote-mcp-gateway": "npm run build && node scripts/test-remote-mcp-gateway.js",
     "test:e2e-onboarding-personas": "npm run build && node scripts/test-e2e-onboarding-personas.js",
+    "test:onboarding-transaction": "npm run build && node scripts/test-onboarding-transaction.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "test:daemon-e2e": "npm run build && node scripts/test-daemon-e2e.js",
+    "test:integrity": "npm run build && node scripts/test-integrity.js",
+    "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
+    "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },
   "keywords": [