fullcourtdefense-cli 1.15.6 → 1.15.7

package/dist/commands/daemon.js

@@ -47,6 +47,7 @@ const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
+const discoveryMarker_1 = require("../discoveryMarker");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -69,6 +70,8 @@ const RESCAN_INTERVAL_MS = envMs('FCD_DAEMON_RESCAN_MS', 5 * 60_000);
 const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
 /** Bundle (mode / suspension / policy version) poll cadence. */
 const BUNDLE_POLL_MS = envMs('FCD_DAEMON_BUNDLE_POLL_MS', 60_000);
+/** Delay before the one-time initial discovery sweep on a fresh machine. */
+const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60_000);
 /** Rotate the daemon log when it grows past this size. */
 const LOG_MAX_BYTES = 1_000_000;
 function daemonDir() {
@@ -129,6 +132,21 @@ function stopPid(pid) {
 function logFile() {
     return path.join(daemonDir(), 'daemon.log');
 }
+/** Spawn `discover --upload --surface all --silent` and wait for it to finish. */
+function runDiscoverSweep(timeoutMs = 300_000) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
+            windowsHide: true,
+            stdio: 'ignore',
+        });
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error(`Discovery command timed out after ${Math.round(timeoutMs / 60_000)} minutes`));
+        }, timeoutMs);
+        child.on('error', error => { clearTimeout(timer); reject(error); });
+        child.on('close', code => { clearTimeout(timer); resolve(code ?? 1); });
+    });
+}
 function cliEntry() {
     return path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
 }
@@ -193,8 +211,12 @@ function acquirePidLock() {
             // No meta = pre-1.15.4 build (never wrote one) → treated as older.
             if (compareVersions(cliVersion(), runningVersion) > 0) {
                 log(`Superseding older daemon (pid ${existing}, version ${runningVersion || 'unknown'}) with ${cliVersion() || 'this build'}.`);
-                if (!stopPid(existing))
-                    return false; // could not stop it — yield rather than double-run
+                if (!stopPid(existing)) {
+                    // Elevated daemons (e.g. spawned by an elevated MSI install) cannot be
+                    // stopped from a normal-user CLI — surface the real reason.
+                    log(`Could not stop daemon pid ${existing} — it may be running elevated. Run this command from an elevated terminal, or reboot so the logon autostart takes over.`);
+                    return false; // yield rather than double-run
+                }
             }
             else {
                 return false;
@@ -448,18 +470,7 @@ async function runDaemon(args, config) {
                 await uploadLogTail();
                 const logPump = setInterval(() => { void uploadLogTail(); }, 15_000);
                 try {
-                    const exitCode = await new Promise((resolve, reject) => {
-                        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
-                            windowsHide: true,
-                            stdio: 'ignore',
-                        });
-                        const timer = setTimeout(() => {
-                            child.kill();
-                            reject(new Error('Discovery command timed out after 5 minutes'));
-                        }, 300_000);
-                        child.on('error', error => { clearTimeout(timer); reject(error); });
-                        child.on('close', code => { clearTimeout(timer); resolve(code ?? 1); });
-                    });
+                    const exitCode = await runDiscoverSweep();
                     if (exitCode !== 0)
                         throw new Error(`Discovery command failed with exit code ${exitCode}`);
                 }
@@ -549,6 +560,34 @@ async function runDaemon(args, config) {
     // One protective pass at startup so a machine that drifted while the daemon
     // was down converges immediately.
     await reprotect(['startup pass']);
+    // Fresh machines have never uploaded an inventory (MSI/onboard defers the
+    // initial discovery to keep setup fast), so the dashboard shows "Never" for
+    // discovery + posture until the daily scheduled job fires — up to 24h later.
+    // Run ONE full sweep shortly after the first daemon boot instead, then leave
+    // a marker so subsequent boots skip it (the daily job owns refreshes).
+    let initialDiscoverTimer;
+    if (creds.shieldId && !(0, discoveryMarker_1.hasDiscoveryUploadMarker)()) {
+        log(`Initial discovery: no prior inventory upload found — full sweep scheduled in ${Math.round(INITIAL_DISCOVER_DELAY_MS / 60_000)} min.`);
+        initialDiscoverTimer = setTimeout(async () => {
+            if (stopped)
+                return;
+            log('Initial discovery: starting full surface sweep (MCP + secrets + agent files + posture)…');
+            await uploadLogTail();
+            try {
+                const exitCode = await runDiscoverSweep();
+                if (exitCode !== 0)
+                    throw new Error(`discover exited with code ${exitCode}`);
+                // The discover child writes the upload marker itself on success, so
+                // subsequent boots skip this. On failure the next daemon start
+                // retries, and the daily scheduled job remains the backstop.
+                log('Initial discovery: upload complete — dashboard discovery + posture timestamps are now fresh.');
+            }
+            catch (error) {
+                log(`Initial discovery failed (will retry on next daemon start): ${error.message}`);
+            }
+            await uploadLogTail();
+        }, INITIAL_DISCOVER_DELAY_MS);
+    }
     const rescanTimer = setInterval(() => {
         const count = refreshWatchTargets();
         log(`Rescan: watching ${count} config file(s).`);
@@ -563,6 +602,8 @@ async function runDaemon(args, config) {
         clearInterval(rescanTimer);
         clearInterval(bundleTimer);
         clearInterval(heartbeatTimer);
+        if (initialDiscoverTimer)
+            clearTimeout(initialDiscoverTimer);
         if (debounceTimer)
             clearTimeout(debounceTimer);
         for (const watcher of watchers.values())
@@ -603,7 +644,7 @@ function isWindowsRunKeyInstalled() {
 /** Launch the daemon right now, outside our own process tree. WMI process
  *  creation escapes the Windows Installer job object, which would otherwise
  *  kill the daemon the moment an MSI custom action finishes. */
-function startDaemonNowWindows(vbs) {
+function startDaemonNowWindows(vbs, viaTask = false) {
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing)) {
@@ -617,6 +658,15 @@ function startDaemonNowWindows(vbs) {
         }
     }
     catch { /* not running */ }
+    if (viaTask) {
+        // Start through the scheduled task so the daemon runs with the task's
+        // LIMITED (non-elevated) token. Launching directly from an elevated MSI
+        // custom action would leave an elevated daemon that a normal-user CLI can
+        // never stop or supersede.
+        const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+        if (run.status === 0)
+            return;
+    }
     const escaped = vbs.replace(/'/g, "''");
     (0, child_process_1.spawnSync)('powershell', [
         '-NoProfile', '-NonInteractive', '-Command',
@@ -631,7 +681,8 @@ function installWindows() {
         '/Create', '/TN', TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
         '/SC', 'ONLOGON', '/F', '/RL', 'LIMITED',
     ], { stdio: 'ignore', windowsHide: true });
-    let ok = task.status === 0;
+    const taskOk = task.status === 0;
+    let ok = taskOk;
     if (!ok) {
         // Fallback: per-user Run key — no elevation needed, runs at every logon.
         const reg = (0, child_process_1.spawnSync)('reg', [
@@ -641,7 +692,7 @@ function installWindows() {
         ok = reg.status === 0;
     }
     if (ok)
-        startDaemonNowWindows(vbs);
+        startDaemonNowWindows(vbs, taskOk);
     return ok;
 }
 function uninstallWindows() {
@@ -815,6 +866,19 @@ async function daemonCommand(args, config) {
         const ok = process.platform === 'win32' ? uninstallWindows()
             : process.platform === 'darwin' ? uninstallMacos()
                 : uninstallLinux();
+        // Uninstall must also STOP the resident daemon — otherwise it keeps running
+        // (heartbeats, log writes) until the next reboot and holds ~/.fullcourtdefense.
+        const meta = readDaemonMeta();
+        if (meta?.pid && meta.pid !== process.pid && isPidAlive(meta.pid)) {
+            const stopped = stopPid(meta.pid);
+            console.log(stopped
+                ? `${COLOR.green}Stopped the running daemon (pid ${meta.pid}).${COLOR.reset}`
+                : `${COLOR.yellow}Could not stop the running daemon (pid ${meta.pid}) — it may be running elevated. Stop it from an elevated terminal: taskkill /PID ${meta.pid} /F${COLOR.reset}`);
+        }
+        try {
+            fs.unlinkSync(metaFile());
+        }
+        catch { /* may not exist */ }
         console.log(ok
             ? `${COLOR.green}Removed the FullCourtDefense daemon autostart.${COLOR.reset}`
             : `${COLOR.yellow}No daemon autostart found (or removal failed).${COLOR.reset}`);

package/dist/commands/discover.js

@@ -50,6 +50,7 @@ const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverBlastRadius_1 = require("./discoverBlastRadius");
 const discoverSecrets_1 = require("./discoverSecrets");
 const windowsAudit_1 = require("./windowsAudit");
+const discoveryMarker_1 = require("../discoveryMarker");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function parseSurfaces(args) {
     const raw = (args.surface || args.type || 'mcp').toLowerCase().trim();
@@ -696,6 +697,9 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
         throw new Error(data.error || `Upload failed (${resp.status})`);
     }
     const ingested = data.data?.ingested ?? servers.length;
+    // Any successful inventory upload satisfies the daemon's "initial discovery"
+    // requirement — onboard-time, manual, scheduled, or remote-action sweeps all count.
+    (0, discoveryMarker_1.writeDiscoveryUploadMarker)('discover_upload');
     const postureNote = extras?.posture ? ` · machine score ${extras.posture.score}/100 (${extras.posture.grade})` : '';
     console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory${postureNote}.${COLOR.reset}`);
 }

package/dist/commands/mcpGateway.js

@@ -1336,6 +1336,22 @@ function extractWrappedDownstream(entry) {
     }
     return { kind: 'stdio', command, args: downstreamArgs };
 }
+/**
+ * Like extractWrappedDownstream, but peels NESTED gateway wraps until the real
+ * server surfaces. Old CLIs compared the wrapper against their own node path, so
+ * an npm install and an MSI install could wrap each other's wraps repeatedly —
+ * unwrapping must restore the original server no matter how deep that went.
+ */
+function extractFullyUnwrappedDownstream(entry) {
+    let downstream = extractWrappedDownstream(entry);
+    for (let depth = 0; depth < 20 && downstream && downstream.kind === 'stdio' && downstream.args.includes('mcp-gateway'); depth++) {
+        const inner = extractWrappedDownstream({ args: downstream.args });
+        if (!inner)
+            break;
+        downstream = inner;
+    }
+    return downstream;
+}
 /** All server maps inside a parsed JSON config, across every known client shape. */
 function collectJsonServerMaps(json) {
     const maps = [];
@@ -1535,7 +1551,7 @@ function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
                 // the original downstream server from the existing wrapper args and
                 // rewrap with the fixed matched-pair credential handling.
                 if (isGatewayWrappedEntry(entry) && wrappedEntryNeedsHeal(entry)) {
-                    const downstream = extractWrappedDownstream(entry);
+                    const downstream = extractFullyUnwrappedDownstream(entry);
                     if (downstream) {
                         const perServer = { ...gatewayConfig, agentClient, agentName: perServerAgentName(gatewayConfig.developerName, agentClient, name) };
                         entry.command = nodeExe;
@@ -1612,7 +1628,7 @@ function unwrapJsonConfigFile(file, dryRun) {
             }
             if (!isGatewayWrappedEntry(entry))
                 continue;
-            const downstream = extractWrappedDownstream(entry);
+            const downstream = extractFullyUnwrappedDownstream(entry);
             if (!downstream)
                 continue;
             if (downstream.kind === 'http') {
@@ -1731,7 +1747,11 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
         if (section.cmdLine === -1 || !section.command) {
             continue;
         }
-        const wrappedAlready = section.command === nodeExe && (section.args || []).includes('mcp-gateway');
+        // Command-agnostic like the JSON path: a wrap made by ANY CLI install (npm node,
+        // MSI runtime node, different nvm version) must be recognized — comparing against
+        // THIS process's node path made one install re-wrap another install's wrap and
+        // left unprotect-all unable to remove it.
+        const wrappedAlready = (section.args || []).includes('mcp-gateway');
         if (mode === 'wrap') {
             if (section.name === MANAGED_SERVER_NAME || wrappedAlready) {
                 stats.skippedManaged.push(section.name);
@@ -1752,7 +1772,7 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
         else {
             if (!wrappedAlready)
                 continue;
-            const downstream = extractWrappedDownstream({ args: section.args });
+            const downstream = extractFullyUnwrappedDownstream({ args: section.args });
             // Codex TOML wraps are always stdio (remote URLs never get wrapped into TOML).
             if (!downstream || downstream.kind !== 'stdio')
                 continue;

package/dist/discoveryMarker.d.ts

@@ -0,0 +1,2 @@
+export declare function hasDiscoveryUploadMarker(): boolean;
+export declare function writeDiscoveryUploadMarker(trigger: string): void;

package/dist/discoveryMarker.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasDiscoveryUploadMarker = hasDiscoveryUploadMarker;
+exports.writeDiscoveryUploadMarker = writeDiscoveryUploadMarker;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Marker recording that this machine has uploaded at least one full discovery
+ * inventory. The daemon uses it to decide whether a fresh machine still needs
+ * its one-time initial sweep (MSI/onboard defer discovery to keep setup fast,
+ * which otherwise leaves the dashboard showing "Never" until the daily job).
+ */
+function markerFile() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'initial-discover.json');
+}
+function hasDiscoveryUploadMarker() {
+    try {
+        return fs.existsSync(markerFile());
+    }
+    catch {
+        return false;
+    }
+}
+function writeDiscoveryUploadMarker(trigger) {
+    try {
+        fs.mkdirSync(path.dirname(markerFile()), { recursive: true });
+        fs.writeFileSync(markerFile(), JSON.stringify({ completedAt: new Date().toISOString(), trigger }, null, 2), 'utf8');
+    }
+    catch { /* marker is best-effort */ }
+}

package/dist/machineIdentity.js

@@ -77,11 +77,17 @@ function normalizeHostname(raw) {
 function rawStableId() {
     const platform = os.platform();
     if (platform === 'win32') {
-        return safe(() => {
-            const out = (0, child_process_1.execFileSync)('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf8', windowsHide: true, timeout: 4000 });
+        // MachineGuid lives only in the 64-bit registry view. When this process is
+        // 32-bit (e.g. spawned by an MSI custom action via SysWOW64 PowerShell),
+        // a plain query is redirected to WOW6432Node and finds nothing — which
+        // would silently change the machineId and enroll a DUPLICATE fleet record.
+        // Query the 64-bit view first, then fall back for true 32-bit Windows.
+        const queryMachineGuid = (extraArgs) => safe(() => {
+            const out = (0, child_process_1.execFileSync)('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid', ...extraArgs], { encoding: 'utf8', windowsHide: true, timeout: 4000 });
             const match = out.match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
             return match ? match[1] : undefined;
         });
+        return queryMachineGuid(['/reg:64']) || queryMachineGuid([]);
     }
     if (platform === 'darwin') {
         return safe(() => {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.6"
+  "version": "1.15.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.6",
+  "version": "1.15.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {