fullcourtdefense-cli 1.15.3 → 1.15.5

package/dist/commands/daemon.js

@@ -77,6 +77,55 @@ function daemonDir() {
 function pidFile() {
     return path.join(daemonDir(), 'daemon.pid');
 }
+/** Sidecar next to the pid lock recording WHICH build owns the daemon. */
+function metaFile() {
+    return path.join(daemonDir(), 'daemon.meta.json');
+}
+function readDaemonMeta() {
+    try {
+        const meta = JSON.parse(fs.readFileSync(metaFile(), 'utf8'));
+        return meta && typeof meta.pid === 'number' ? meta : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeDaemonMeta() {
+    try {
+        const meta = {
+            pid: process.pid,
+            version: cliVersion(),
+            entry: cliEntry(),
+            startedAt: new Date().toISOString(),
+        };
+        fs.writeFileSync(metaFile(), JSON.stringify(meta, null, 2), 'utf8');
+    }
+    catch { /* best-effort */ }
+}
+/** Kill a process and wait (up to ~5s) for it to actually exit. */
+function stopPid(pid) {
+    try {
+        process.kill(pid);
+    }
+    catch { /* may already be gone */ }
+    const deadline = Date.now() + 5_000;
+    const sleeper = new Int32Array(new SharedArrayBuffer(4));
+    while (Date.now() < deadline) {
+        if (!isPidAlive(pid))
+            return true;
+        Atomics.wait(sleeper, 0, 0, 250);
+    }
+    if (process.platform === 'win32') {
+        (0, child_process_1.spawnSync)('taskkill', ['/PID', String(pid), '/F'], { stdio: 'ignore', windowsHide: true, timeout: 5_000 });
+    }
+    else {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch { /* ignore */ }
+    }
+    return !isPidAlive(pid);
+}
 function logFile() {
     return path.join(daemonDir(), 'daemon.log');
 }
@@ -117,24 +166,56 @@ function isPidAlive(pid) {
         return error.code === 'EPERM';
     }
 }
-/** Take the single-instance lock. Returns false when another daemon is already running. */
+/** Lexicographic-free semver compare; missing/unparseable sorts oldest. */
+function compareVersions(a, b) {
+    const parse = (value) => String(value || '0').split('.').map(part => parseInt(part, 10) || 0);
+    const [pa, pb] = [parse(a), parse(b)];
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const diff = (pa[i] || 0) - (pb[i] || 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+/**
+ * Take the single-instance lock. A NEWER build supersedes a running older
+ * daemon (e.g. the MSI-bundled copy kept running after an npm update): the old
+ * process is stopped and this one takes over, so the fleet never keeps running
+ * stale enforcement code silently. Same-or-newer versions keep the lock.
+ */
 function acquirePidLock() {
     fs.mkdirSync(daemonDir(), { recursive: true });
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         if (Number.isFinite(existing) && existing > 0 && existing !== process.pid && isPidAlive(existing)) {
-            return false;
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === existing ? meta.version : undefined;
+            // No meta = pre-1.15.4 build (never wrote one) → treated as older.
+            if (compareVersions(cliVersion(), runningVersion) > 0) {
+                log(`Superseding older daemon (pid ${existing}, version ${runningVersion || 'unknown'}) with ${cliVersion() || 'this build'}.`);
+                if (!stopPid(existing))
+                    return false; // could not stop it — yield rather than double-run
+            }
+            else {
+                return false;
+            }
         }
     }
     catch { /* no pidfile — free to start */ }
     fs.writeFileSync(pidFile(), String(process.pid), 'utf8');
+    writeDaemonMeta();
     return true;
 }
 function releasePidLock() {
     try {
         const recorded = Number(fs.readFileSync(pidFile(), 'utf8').trim());
-        if (recorded === process.pid)
+        if (recorded === process.pid) {
             fs.unlinkSync(pidFile());
+            try {
+                fs.unlinkSync(metaFile());
+            }
+            catch { /* best-effort */ }
+        }
     }
     catch { /* best-effort */ }
 }
@@ -356,6 +437,7 @@ async function runDaemon(args, config) {
                 shieldKey: creds.shieldKey,
                 developerName: identity.developerName,
                 machineName: identity.hostname,
+                machineId: identity.machineId,
                 force: true,
             });
             if (bundle.suspended && !suspended) {
@@ -467,8 +549,15 @@ function isWindowsRunKeyInstalled() {
 function startDaemonNowWindows(vbs) {
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
-        if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing))
-            return;
+        if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing)) {
+            // Skip only when the running daemon is the same version or newer; an
+            // older one (e.g. stale MSI copy) gets superseded by the spawned daemon,
+            // whose acquirePidLock() stops it and takes over.
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === existing ? meta.version : undefined;
+            if (compareVersions(cliVersion(), runningVersion) <= 0)
+                return;
+        }
     }
     catch { /* not running */ }
     const escaped = vbs.replace(/'/g, "''");
@@ -513,23 +602,23 @@ function launchdPlistPath() {
     return path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
 }
 function installMacos() {
-    const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${LAUNCHD_LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${process.execPath}</string>
-    <string>${cliEntry()}</string>
-    <string>daemon</string>
-  </array>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logFile()}</string>
-  <key>StandardErrorPath</key><string>${logFile()}</string>
-</dict>
-</plist>
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${process.execPath}</string>
+    <string>${cliEntry()}</string>
+    <string>daemon</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${logFile()}</string>
+  <key>StandardErrorPath</key><string>${logFile()}</string>
+</dict>
+</plist>
 `;
     const file = launchdPlistPath();
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -567,16 +656,16 @@ function isDaemonAutostartInstalled() {
     return fs.existsSync(systemdUnitPath());
 }
 function installLinux() {
-    const unit = `[Unit]
-Description=FullCourtDefense resident daemon (config watch + heartbeat)
-
-[Service]
-ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=default.target
+    const unit = `[Unit]
+Description=FullCourtDefense resident daemon (config watch + heartbeat)
+
+[Service]
+ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target
 `;
     const file = systemdUnitPath();
     try {
@@ -621,9 +710,20 @@ function statusCommand() {
     try {
         const pid = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         running = Number.isFinite(pid) && pid > 0 && isPidAlive(pid);
-        console.log(running
-            ? `${COLOR.green}Running${COLOR.reset} (pid ${pid})`
-            : `${COLOR.yellow}Not running${COLOR.reset} (stale pid file: ${pidFile()})`);
+        if (running) {
+            const meta = readDaemonMeta();
+            const runningVersion = meta && meta.pid === pid ? meta.version : undefined;
+            const mine = cliVersion();
+            console.log(`${COLOR.green}Running${COLOR.reset} (pid ${pid}, version ${runningVersion || 'unknown — pre-1.15.4 build'})`);
+            if (meta?.entry)
+                console.log(`${COLOR.gray}Binary:${COLOR.reset} ${meta.entry}`);
+            if (mine && compareVersions(mine, runningVersion) > 0) {
+                console.log(`${COLOR.yellow}Outdated:${COLOR.reset} this CLI is ${mine} — run ${COLOR.bold}fullcourtdefense daemon${COLOR.reset} to supersede the old daemon.`);
+            }
+        }
+        else {
+            console.log(`${COLOR.yellow}Not running${COLOR.reset} (stale pid file: ${pidFile()})`);
+        }
     }
     catch {
         console.log(`${COLOR.yellow}Not running${COLOR.reset} (no pid file)`);
@@ -631,7 +731,16 @@ function statusCommand() {
     console.log(`${COLOR.gray}Log:${COLOR.reset} ${logFile()}`);
     console.log(`${COLOR.gray}Autostart:${COLOR.reset}`);
     if (process.platform === 'win32') {
-        (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'inherit' });
+        const task = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 5_000 });
+        if (task.status === 0) {
+            console.log(`  Scheduled Task "${TASK_NAME}" installed`);
+        }
+        else if (isWindowsRunKeyInstalled()) {
+            console.log(`  Run key installed (HKCU\\...\\Run\\${WINDOWS_RUN_VALUE}) — starts at logon`);
+        }
+        else {
+            console.log('  not installed — run: fullcourtdefense daemon --install true');
+        }
     }
     else if (process.platform === 'darwin') {
         console.log(fs.existsSync(launchdPlistPath()) ? `  launchd agent installed (${launchdPlistPath()})` : '  not installed');

package/dist/runtimeConfig.d.ts

@@ -39,6 +39,8 @@ export interface FetchBundleInput {
     shieldKey?: string;
     developerName?: string;
     machineName?: string;
+    /** Exact fleet machine ID — makes the server's pending-action lookup deterministic. */
+    machineId?: string;
     /** Override cache TTL (ms). */
     ttlMs?: number;
     /** Force a network refresh regardless of cache freshness. */

package/dist/runtimeConfig.js

@@ -83,6 +83,8 @@ async function getRuntimeBundle(input) {
             params.set('developerName', input.developerName);
         if (input.machineName)
             params.set('machineName', input.machineName);
+        if (input.machineId)
+            params.set('machineId', input.machineId);
         const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, { method: 'GET', headers, signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS) });
         // 304 Not Modified — cache is still valid; refresh its timestamp.
         if (resp.status === 304 && cached) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.3"
+  "version": "1.15.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.3",
+  "version": "1.15.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {