fullcourtdefense-cli 1.15.2 → 1.15.3

package/dist/commands/daemon.js

@@ -42,6 +42,7 @@ const child_process_1 = require("child_process");
 const config_1 = require("../config");
 const mcpGateway_1 = require("./mcpGateway");
 const runtimeConfig_1 = require("../runtimeConfig");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
@@ -288,7 +289,28 @@ async function runDaemon(args, config) {
                     throw new Error(resultSummary);
             }
             else if (action.type === 'policy_refresh') {
-                resultSummary = 'Policy bundle refreshed from the control plane.';
+                if (!creds.shieldId)
+                    throw new Error('Shield not configured on this machine.');
+                const shieldId = creds.shieldId;
+                const identity = (0, machineIdentity_1.getMachineIdentity)();
+                const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                    apiUrl: creds.apiUrl,
+                    shieldId,
+                    shieldKey: creds.shieldKey,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                    force: true,
+                    ttlMs: 0,
+                });
+                (0, localSafetySnapshot_1.clearLocalSafetySnapshotCache)({
+                    apiUrl: creds.apiUrl,
+                    shieldId,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                });
+                resultSummary = bundle.policyHash
+                    ? `Policy bundle refreshed (hash ${bundle.policyHash.slice(0, 12)}…).`
+                    : 'Policy bundle refreshed from the control plane.';
             }
             else if (action.type === 'repair_protection') {
                 if (suspended)
@@ -301,15 +323,18 @@ async function runDaemon(args, config) {
                 resultSummary = 'AgentGuard hooks, gateways, and protection configuration were repaired and verified.';
             }
             else if (action.type === 'discovery_scan') {
-                const result = (0, child_process_1.spawnSync)(process.execPath, [cliEntry(), 'discover', '--upload'], {
+                // Full surface sweep (MCP + secrets + agent-files + posture) so a remote
+                // "Run discovery" refreshes BOTH the discovery and the posture scan
+                // timestamps in the dashboard — not just the MCP inventory.
+                const result = (0, child_process_1.spawnSync)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
                     encoding: 'utf8',
                     windowsHide: true,
-                    timeout: 180_000,
+                    timeout: 300_000,
                 });
                 if (result.status !== 0) {
                     throw new Error((result.stderr || result.stdout || 'Discovery command failed').trim().slice(0, 500));
                 }
-                resultSummary = 'Discovery scan completed and uploaded.';
+                resultSummary = 'Discovery + posture scan completed and uploaded.';
             }
             await reportMachineAction(action.id, 'succeeded', { resultSummary });
             log(`Remote action succeeded: ${action.type}.`);
@@ -323,11 +348,14 @@ async function runDaemon(args, config) {
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        const identity = (0, machineIdentity_1.getMachineIdentity)();
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
                 apiUrl: creds.apiUrl,
                 shieldId: creds.shieldId,
                 shieldKey: creds.shieldKey,
+                developerName: identity.developerName,
+                machineName: identity.hostname,
                 force: true,
             });
             if (bundle.suspended && !suspended) {
@@ -485,23 +513,23 @@ function launchdPlistPath() {
     return path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
 }
 function installMacos() {
-    const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${process.execPath}</string>
-    <string>${cliEntry()}</string>
-    <string>daemon</string>
-  </array>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logFile()}</string>
-  <key>StandardErrorPath</key><string>${logFile()}</string>
-</dict>
-</plist>
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${process.execPath}</string>
+    <string>${cliEntry()}</string>
+    <string>daemon</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${logFile()}</string>
+  <key>StandardErrorPath</key><string>${logFile()}</string>
+</dict>
+</plist>
 `;
     const file = launchdPlistPath();
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -539,16 +567,16 @@ function isDaemonAutostartInstalled() {
     return fs.existsSync(systemdUnitPath());
 }
 function installLinux() {
-    const unit = `[Unit]
-Description=FullCourtDefense resident daemon (config watch + heartbeat)
-
-[Service]
-ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=default.target
+    const unit = `[Unit]
+Description=FullCourtDefense resident daemon (config watch + heartbeat)
+
+[Service]
+ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target
 `;
     const file = systemdUnitPath();
     try {

package/dist/config.js

@@ -157,23 +157,29 @@ function readConfigFile(filePath) {
 function powershellDpapi(script, value) {
     if (process.platform !== 'win32' || !value)
         return undefined;
-    try {
-        return (0, child_process_1.execFileSync)('powershell.exe', [
-            '-NoProfile',
-            '-NonInteractive',
-            '-ExecutionPolicy', 'Bypass',
-            '-Command', script,
-        ], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            env: { ...process.env, FCD_DPAPI_VALUE: value },
-            timeout: 5_000,
-            windowsHide: true,
-        }).trim() || undefined;
-    }
-    catch {
-        return undefined;
+    // Windows PowerShell 5.1 first, then PowerShell 7 — both use DPAPI for
+    // SecureString on Windows. Some locked-down/service contexts (e.g. CI
+    // runners) break one shell but not the other.
+    for (const shell of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const output = (0, child_process_1.execFileSync)(shell, [
+                '-NoProfile',
+                '-NonInteractive',
+                '-ExecutionPolicy', 'Bypass',
+                '-Command', script,
+            ], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                env: { ...process.env, FCD_DPAPI_VALUE: value },
+                timeout: 15_000,
+                windowsHide: true,
+            }).trim();
+            if (output)
+                return output;
+        }
+        catch { /* try the next shell */ }
     }
+    return undefined;
 }
 function protectShieldKeyForCurrentWindowsUser(value) {
     return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE -AsPlainText -Force; ConvertFrom-SecureString -SecureString $secure', value);

package/dist/localSafetySnapshot.d.ts

@@ -14,5 +14,6 @@ export interface LocalSafetySnapshotInput {
     expectedPolicyHash?: string;
     timeoutMs?: number;
 }
+export declare function clearLocalSafetySnapshotCache(input: Pick<LocalSafetySnapshotInput, 'apiUrl' | 'shieldId' | 'developerName' | 'machineName'>): void;
 export declare function loadLocalSafetySnapshot(input: LocalSafetySnapshotInput): Promise<LocalSafetySnapshot | undefined>;
 export declare function snapshotToScanOptions(snapshot: LocalSafetySnapshot | undefined, extra?: Pick<LocalSafetyScanOptions, 'cwd' | 'inspectScripts'>): LocalSafetyScanOptions;

package/dist/localSafetySnapshot.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearLocalSafetySnapshotCache = clearLocalSafetySnapshotCache;
 exports.loadLocalSafetySnapshot = loadLocalSafetySnapshot;
 exports.snapshotToScanOptions = snapshotToScanOptions;
 const crypto = __importStar(require("crypto"));
@@ -86,6 +87,12 @@ function toSnapshot(data) {
         updatedAt: typeof data.updatedAt === 'string' ? data.updatedAt : undefined,
     };
 }
+function clearLocalSafetySnapshotCache(input) {
+    try {
+        fs.unlinkSync(cachePath(input));
+    }
+    catch { /* cache may not exist */ }
+}
 async function loadLocalSafetySnapshot(input) {
     const file = cachePath(input);
     const cached = readCache(file);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.2"
+  "version": "1.15.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.2",
+  "version": "1.15.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {