fullcourtdefense-cli 1.15.4 → 1.15.6

package/dist/commands/daemon.js

@@ -266,6 +266,7 @@ async function runDaemon(args, config) {
             await (0, mcpGateway_1.protectAllCommand)({ ...args, dryRun: undefined }, config);
             quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
             log('Re-protection pass complete.');
+            await uploadLogTail();
             if (!quiet) {
                 (0, notify_1.notifyOs)({
                     title: 'FullCourtDefense re-protected this machine',
@@ -329,6 +330,28 @@ async function runDaemon(args, config) {
         }
         return targets.length;
     };
+    // Ship the REAL daemon log tail to the control plane so the dashboard's
+    // machine page can show live progress (protect-all passes, cache clears,
+    // discovery sweeps). Best-effort — never blocks or fails the daemon.
+    const uploadLogTail = async () => {
+        if (!creds.shieldId)
+            return;
+        try {
+            const raw = fs.readFileSync(logFile(), 'utf8');
+            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-80);
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            await fetch(`${creds.apiUrl}/api/cli/machines/log`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(creds.shieldKey ? { 'x-shield-key': creds.shieldKey } : {}),
+                },
+                body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, lines }),
+                signal: AbortSignal.timeout(8_000),
+            });
+        }
+        catch { /* log shipping is best-effort */ }
+    };
     const reportMachineAction = async (actionId, status, detail) => {
         if (!creds.shieldId)
             return;
@@ -359,10 +382,16 @@ async function runDaemon(args, config) {
         executingActionIds.add(action.id);
         await reportMachineAction(action.id, 'running');
         log(`Remote action started: ${action.type} (${action.id}).`);
+        await uploadLogTail();
         try {
             let resultSummary = '';
             if (action.type === 'health_check') {
+                log('Health check: verifying daemon + protection surfaces…');
+                await uploadLogTail();
                 const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+                log(integrity.ok
+                    ? `Health check: all protection points healthy (${integrity.protectedMcpConfigs}/${integrity.discoveredMcpConfigs} MCP configs wrapped).`
+                    : `Health check: issues found — ${integrity.reasons.join(', ')}.`);
                 resultSummary = integrity.ok
                     ? 'Daemon and required AgentGuard protection points are healthy.'
                     : `Health check found: ${integrity.reasons.join(', ')}`;
@@ -374,21 +403,28 @@ async function runDaemon(args, config) {
                     throw new Error('Shield not configured on this machine.');
                 const shieldId = creds.shieldId;
                 const identity = (0, machineIdentity_1.getMachineIdentity)();
-                const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                log('Policy refresh: clearing Local Safety snapshot cache…');
+                (0, localSafetySnapshot_1.clearLocalSafetySnapshotCache)({
                     apiUrl: creds.apiUrl,
                     shieldId,
-                    shieldKey: creds.shieldKey,
                     developerName: identity.developerName,
                     machineName: identity.hostname,
-                    force: true,
-                    ttlMs: 0,
                 });
-                (0, localSafetySnapshot_1.clearLocalSafetySnapshotCache)({
+                await uploadLogTail();
+                log('Policy refresh: pulling latest policy bundle from control plane…');
+                const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
                     apiUrl: creds.apiUrl,
                     shieldId,
+                    shieldKey: creds.shieldKey,
                     developerName: identity.developerName,
                     machineName: identity.hostname,
+                    machineId: identity.machineId,
+                    force: true,
+                    ttlMs: 0,
                 });
+                log(bundle.policyHash
+                    ? `Policy refresh: bundle applied (hash ${bundle.policyHash.slice(0, 12)}…, ${bundle.policyCount ?? 0} policies).`
+                    : 'Policy refresh: bundle applied from control plane.');
                 resultSummary = bundle.policyHash
                     ? `Policy bundle refreshed (hash ${bundle.policyHash.slice(0, 12)}…).`
                     : 'Policy bundle refreshed from the control plane.';
@@ -396,25 +432,41 @@ async function runDaemon(args, config) {
             else if (action.type === 'repair_protection') {
                 if (suspended)
                     throw new Error('Machine is suspended; resume it before repairing protection.');
+                log('Repair protection: running protect-all (IDE hooks + MCP gateways)…');
+                await uploadLogTail();
                 await (0, mcpGateway_1.protectAllCommand)({ ...args, dryRun: undefined }, config);
+                log('Repair protection: verifying hooks, gateways and daemon integrity…');
                 const verification = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
                 if (!verification.ok) {
                     throw new Error(`Repair completed but verification still reports: ${verification.reasons.join(', ')}`);
                 }
+                log(`Repair protection: verified (${verification.protectedMcpConfigs}/${verification.discoveredMcpConfigs} MCP configs wrapped).`);
                 resultSummary = 'AgentGuard hooks, gateways, and protection configuration were repaired and verified.';
             }
             else if (action.type === 'discovery_scan') {
-                // Full surface sweep (MCP + secrets + agent-files + posture) so a remote
-                // "Run discovery" refreshes BOTH the discovery and the posture scan
-                // timestamps in the dashboard — not just the MCP inventory.
-                const result = (0, child_process_1.spawnSync)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
-                    encoding: 'utf8',
-                    windowsHide: true,
-                    timeout: 300_000,
-                });
-                if (result.status !== 0) {
-                    throw new Error((result.stderr || result.stdout || 'Discovery command failed').trim().slice(0, 500));
+                log('Discovery scan: starting full surface sweep (MCP + secrets + agent files + posture)…');
+                await uploadLogTail();
+                const logPump = setInterval(() => { void uploadLogTail(); }, 15_000);
+                try {
+                    const exitCode = await new Promise((resolve, reject) => {
+                        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
+                            windowsHide: true,
+                            stdio: 'ignore',
+                        });
+                        const timer = setTimeout(() => {
+                            child.kill();
+                            reject(new Error('Discovery command timed out after 5 minutes'));
+                        }, 300_000);
+                        child.on('error', error => { clearTimeout(timer); reject(error); });
+                        child.on('close', code => { clearTimeout(timer); resolve(code ?? 1); });
+                    });
+                    if (exitCode !== 0)
+                        throw new Error(`Discovery command failed with exit code ${exitCode}`);
                 }
+                finally {
+                    clearInterval(logPump);
+                }
+                log('Discovery scan: upload complete — dashboard discovery + posture timestamps will refresh.');
                 resultSummary = 'Discovery + posture scan completed and uploaded.';
             }
             await reportMachineAction(action.id, 'succeeded', { resultSummary });
@@ -425,6 +477,10 @@ async function runDaemon(args, config) {
             await reportMachineAction(action.id, 'failed', { error: message });
             log(`Remote action failed: ${action.type}: ${message}`);
         }
+        finally {
+            executingActionIds.delete(action.id);
+            await uploadLogTail();
+        }
     };
     const pollBundle = async () => {
         if (!creds.shieldId)
@@ -437,6 +493,7 @@ async function runDaemon(args, config) {
                 shieldKey: creds.shieldKey,
                 developerName: identity.developerName,
                 machineName: identity.hostname,
+                machineId: identity.machineId,
                 force: true,
             });
             if (bundle.suspended && !suspended) {
@@ -480,6 +537,7 @@ async function runDaemon(args, config) {
                 log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
             if (!integrity.ok)
                 log(`Integrity warning: ${integrity.reasons.join(', ')}.`);
+            await uploadLogTail();
         }
         catch { /* spool stays on disk for the next tick */ }
     };

package/dist/runtimeConfig.d.ts

@@ -39,6 +39,8 @@ export interface FetchBundleInput {
     shieldKey?: string;
     developerName?: string;
     machineName?: string;
+    /** Exact fleet machine ID — makes the server's pending-action lookup deterministic. */
+    machineId?: string;
     /** Override cache TTL (ms). */
     ttlMs?: number;
     /** Force a network refresh regardless of cache freshness. */

package/dist/runtimeConfig.js

@@ -83,6 +83,8 @@ async function getRuntimeBundle(input) {
             params.set('developerName', input.developerName);
         if (input.machineName)
             params.set('machineName', input.machineName);
+        if (input.machineId)
+            params.set('machineId', input.machineId);
         const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, { method: 'GET', headers, signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS) });
         // 304 Not Modified — cache is still valid; refresh its timestamp.
         if (resp.status === 304 && cached) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.4"
+  "version": "1.15.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.4",
+  "version": "1.15.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {