fullcourtdefense-cli 1.15.2 → 1.15.4

package/dist/commands/daemon.js

@@ -42,6 +42,7 @@ const child_process_1 = require("child_process");
 const config_1 = require("../config");
 const mcpGateway_1 = require("./mcpGateway");
 const runtimeConfig_1 = require("../runtimeConfig");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
@@ -76,6 +77,55 @@ function daemonDir() {
 function pidFile() {
     return path.join(daemonDir(), 'daemon.pid');
 }
+/** Sidecar next to the pid lock recording WHICH build owns the daemon. */
+function metaFile() {
+    return path.join(daemonDir(), 'daemon.meta.json');
+}
+function readDaemonMeta() {
+    try {
+        const meta = JSON.parse(fs.readFileSync(metaFile(), 'utf8'));
+        return meta && typeof meta.pid === 'number' ? meta : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeDaemonMeta() {
+    try {
+        const meta = {
+            pid: process.pid,
+            version: cliVersion(),
+            entry: cliEntry(),
+            startedAt: new Date().toISOString(),
+        };
+        fs.writeFileSync(metaFile(), JSON.stringify(meta, null, 2), 'utf8');
+    }
+    catch { /* best-effort */ }
+}
+/** Kill a process and wait (up to ~5s) for it to actually exit. */
+function stopPid(pid) {
+    try {
+        process.kill(pid);
+    }
+    catch { /* may already be gone */ }
+    const deadline = Date.now() + 5_000;
+    const sleeper = new Int32Array(new SharedArrayBuffer(4));
+    while (Date.now() < deadline) {
+        if (!isPidAlive(pid))
+            return true;
+        Atomics.wait(sleeper, 0, 0, 250);
+    }
+    if (process.platform === 'win32') {
+        (0, child_process_1.spawnSync)('taskkill', ['/PID', String(pid), '/F'], { stdio: 'ignore', windowsHide: true, timeout: 5_000 });
+    }
+    else {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch { /* ignore */ }
+    }
+    return !isPidAlive(pid);
+}
 function logFile() {
     return path.join(daemonDir(), 'daemon.log');
 }
@@ -116,24 +166,56 @@ function isPidAlive(pid) {
         return error.code === 'EPERM';
     }
 }
-/** Take the single-instance lock. Returns false when another daemon is already running. */
+/** Lexicographic-free semver compare; missing/unparseable sorts oldest. */
+function compareVersions(a, b) {
+    const parse = (value) => String(value || '0').split('.').map(part => parseInt(part, 10) || 0);
+    const [pa, pb] = [parse(a), parse(b)];
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const diff = (pa[i] || 0) - (pb[i] || 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+/**
+ * Take the single-instance lock. A NEWER build supersedes a running older
+ * daemon (e.g. the MSI-bundled copy kept running after an npm update): the old
+ * process is stopped and this one takes over, so the fleet never keeps running
+ * stale enforcement code silently. Same-or-newer versions keep the lock.
+ */
 function acquirePidLock() {
     fs.mkdirSync(daemonDir(), { recursive: true });
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         if (Number.isFinite(existing) && existing > 0 && existing !== process.pid && isPidAlive(existing)) {
-            return false;
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === existing ? meta.version : undefined;
+            // No meta = pre-1.15.4 build (never wrote one) → treated as older.
+            if (compareVersions(cliVersion(), runningVersion) > 0) {
+                log(`Superseding older daemon (pid ${existing}, version ${runningVersion || 'unknown'}) with ${cliVersion() || 'this build'}.`);
+                if (!stopPid(existing))
+                    return false; // could not stop it — yield rather than double-run
+            }
+            else {
+                return false;
+            }
         }
     }
     catch { /* no pidfile — free to start */ }
     fs.writeFileSync(pidFile(), String(process.pid), 'utf8');
+    writeDaemonMeta();
     return true;
 }
 function releasePidLock() {
     try {
         const recorded = Number(fs.readFileSync(pidFile(), 'utf8').trim());
-        if (recorded === process.pid)
+        if (recorded === process.pid) {
             fs.unlinkSync(pidFile());
+            try {
+                fs.unlinkSync(metaFile());
+            }
+            catch { /* best-effort */ }
+        }
     }
     catch { /* best-effort */ }
 }
@@ -288,7 +370,28 @@ async function runDaemon(args, config) {
                     throw new Error(resultSummary);
             }
             else if (action.type === 'policy_refresh') {
-                resultSummary = 'Policy bundle refreshed from the control plane.';
+                if (!creds.shieldId)
+                    throw new Error('Shield not configured on this machine.');
+                const shieldId = creds.shieldId;
+                const identity = (0, machineIdentity_1.getMachineIdentity)();
+                const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                    apiUrl: creds.apiUrl,
+                    shieldId,
+                    shieldKey: creds.shieldKey,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                    force: true,
+                    ttlMs: 0,
+                });
+                (0, localSafetySnapshot_1.clearLocalSafetySnapshotCache)({
+                    apiUrl: creds.apiUrl,
+                    shieldId,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                });
+                resultSummary = bundle.policyHash
+                    ? `Policy bundle refreshed (hash ${bundle.policyHash.slice(0, 12)}…).`
+                    : 'Policy bundle refreshed from the control plane.';
             }
             else if (action.type === 'repair_protection') {
                 if (suspended)
@@ -301,15 +404,18 @@ async function runDaemon(args, config) {
                 resultSummary = 'AgentGuard hooks, gateways, and protection configuration were repaired and verified.';
             }
             else if (action.type === 'discovery_scan') {
-                const result = (0, child_process_1.spawnSync)(process.execPath, [cliEntry(), 'discover', '--upload'], {
+                // Full surface sweep (MCP + secrets + agent-files + posture) so a remote
+                // "Run discovery" refreshes BOTH the discovery and the posture scan
+                // timestamps in the dashboard — not just the MCP inventory.
+                const result = (0, child_process_1.spawnSync)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
                     encoding: 'utf8',
                     windowsHide: true,
-                    timeout: 180_000,
+                    timeout: 300_000,
                 });
                 if (result.status !== 0) {
                     throw new Error((result.stderr || result.stdout || 'Discovery command failed').trim().slice(0, 500));
                 }
-                resultSummary = 'Discovery scan completed and uploaded.';
+                resultSummary = 'Discovery + posture scan completed and uploaded.';
             }
             await reportMachineAction(action.id, 'succeeded', { resultSummary });
             log(`Remote action succeeded: ${action.type}.`);
@@ -323,11 +429,14 @@ async function runDaemon(args, config) {
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        const identity = (0, machineIdentity_1.getMachineIdentity)();
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
                 apiUrl: creds.apiUrl,
                 shieldId: creds.shieldId,
                 shieldKey: creds.shieldKey,
+                developerName: identity.developerName,
+                machineName: identity.hostname,
                 force: true,
             });
             if (bundle.suspended && !suspended) {
@@ -439,8 +548,15 @@ function isWindowsRunKeyInstalled() {
 function startDaemonNowWindows(vbs) {
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
-        if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing))
-            return;
+        if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing)) {
+            // Skip only when the running daemon is the same version or newer; an
+            // older one (e.g. stale MSI copy) gets superseded by the spawned daemon,
+            // whose acquirePidLock() stops it and takes over.
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === existing ? meta.version : undefined;
+            if (compareVersions(cliVersion(), runningVersion) <= 0)
+                return;
+        }
     }
     catch { /* not running */ }
     const escaped = vbs.replace(/'/g, "''");
@@ -593,9 +709,20 @@ function statusCommand() {
     try {
         const pid = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         running = Number.isFinite(pid) && pid > 0 && isPidAlive(pid);
-        console.log(running
-            ? `${COLOR.green}Running${COLOR.reset} (pid ${pid})`
-            : `${COLOR.yellow}Not running${COLOR.reset} (stale pid file: ${pidFile()})`);
+        if (running) {
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === pid ? meta.version : undefined;
+            const mine = cliVersion();
+            console.log(`${COLOR.green}Running${COLOR.reset} (pid ${pid}, version ${runningVersion || 'unknown — pre-1.15.4 build'})`);
+            if (meta?.entry)
+                console.log(`${COLOR.gray}Binary:${COLOR.reset} ${meta.entry}`);
+            if (mine && compareVersions(mine, runningVersion) > 0) {
+                console.log(`${COLOR.yellow}Outdated:${COLOR.reset} this CLI is ${mine} — run ${COLOR.bold}fullcourtdefense daemon${COLOR.reset} to supersede the old daemon.`);
+            }
+        }
+        else {
+            console.log(`${COLOR.yellow}Not running${COLOR.reset} (stale pid file: ${pidFile()})`);
+        }
     }
     catch {
         console.log(`${COLOR.yellow}Not running${COLOR.reset} (no pid file)`);
@@ -603,7 +730,16 @@ function statusCommand() {
     console.log(`${COLOR.gray}Log:${COLOR.reset} ${logFile()}`);
     console.log(`${COLOR.gray}Autostart:${COLOR.reset}`);
     if (process.platform === 'win32') {
-        (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'inherit' });
+        const task = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 5_000 });
+        if (task.status === 0) {
+            console.log(`  Scheduled Task "${TASK_NAME}" installed`);
+        }
+        else if (isWindowsRunKeyInstalled()) {
+            console.log(`  Run key installed (HKCU\\...\\Run\\${WINDOWS_RUN_VALUE}) — starts at logon`);
+        }
+        else {
+            console.log('  not installed — run: fullcourtdefense daemon --install true');
+        }
     }
     else if (process.platform === 'darwin') {
         console.log(fs.existsSync(launchdPlistPath()) ? `  launchd agent installed (${launchdPlistPath()})` : '  not installed');

package/dist/config.js

@@ -157,23 +157,29 @@ function readConfigFile(filePath) {
 function powershellDpapi(script, value) {
     if (process.platform !== 'win32' || !value)
         return undefined;
-    try {
-        return (0, child_process_1.execFileSync)('powershell.exe', [
-            '-NoProfile',
-            '-NonInteractive',
-            '-ExecutionPolicy', 'Bypass',
-            '-Command', script,
-        ], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            env: { ...process.env, FCD_DPAPI_VALUE: value },
-            timeout: 5_000,
-            windowsHide: true,
-        }).trim() || undefined;
-    }
-    catch {
-        return undefined;
+    // Windows PowerShell 5.1 first, then PowerShell 7 — both use DPAPI for
+    // SecureString on Windows. Some locked-down/service contexts (e.g. CI
+    // runners) break one shell but not the other.
+    for (const shell of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const output = (0, child_process_1.execFileSync)(shell, [
+                '-NoProfile',
+                '-NonInteractive',
+                '-ExecutionPolicy', 'Bypass',
+                '-Command', script,
+            ], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                env: { ...process.env, FCD_DPAPI_VALUE: value },
+                timeout: 15_000,
+                windowsHide: true,
+            }).trim();
+            if (output)
+                return output;
+        }
+        catch { /* try the next shell */ }
     }
+    return undefined;
 }
 function protectShieldKeyForCurrentWindowsUser(value) {
     return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE -AsPlainText -Force; ConvertFrom-SecureString -SecureString $secure', value);

package/dist/localSafetySnapshot.d.ts

@@ -14,5 +14,6 @@ export interface LocalSafetySnapshotInput {
     expectedPolicyHash?: string;
     timeoutMs?: number;
 }
+export declare function clearLocalSafetySnapshotCache(input: Pick<LocalSafetySnapshotInput, 'apiUrl' | 'shieldId' | 'developerName' | 'machineName'>): void;
 export declare function loadLocalSafetySnapshot(input: LocalSafetySnapshotInput): Promise<LocalSafetySnapshot | undefined>;
 export declare function snapshotToScanOptions(snapshot: LocalSafetySnapshot | undefined, extra?: Pick<LocalSafetyScanOptions, 'cwd' | 'inspectScripts'>): LocalSafetyScanOptions;

package/dist/localSafetySnapshot.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearLocalSafetySnapshotCache = clearLocalSafetySnapshotCache;
 exports.loadLocalSafetySnapshot = loadLocalSafetySnapshot;
 exports.snapshotToScanOptions = snapshotToScanOptions;
 const crypto = __importStar(require("crypto"));
@@ -86,6 +87,12 @@ function toSnapshot(data) {
         updatedAt: typeof data.updatedAt === 'string' ? data.updatedAt : undefined,
     };
 }
+function clearLocalSafetySnapshotCache(input) {
+    try {
+        fs.unlinkSync(cachePath(input));
+    }
+    catch { /* cache may not exist */ }
+}
 async function loadLocalSafetySnapshot(input) {
     const file = cachePath(input);
     const cached = readCache(file);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.2"
+  "version": "1.15.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.2",
+  "version": "1.15.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {