fullcourtdefense-cli 1.15.7 → 1.15.8

package/dist/commands/daemon.js

@@ -138,6 +138,9 @@ function runDiscoverSweep(timeoutMs = 300_000) {
         const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
             windowsHide: true,
             stdio: 'ignore',
+            // Daemon/scheduled-task cwd is C:\WINDOWS\system32 — scan from the user's
+            // home so the posture scope reports a meaningful folder, not an OS dir.
+            cwd: os.homedir(),
         });
         const timer = setTimeout(() => {
             child.kill();

package/dist/commands/discover.js

@@ -123,6 +123,15 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
 function candidateConfigPaths(cwd, extra) {
     return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
+/** True when a path is an operating-system folder (daemon/scheduled-task cwd), never a real project. */
+function isOsSystemFolder(dir) {
+    const normalized = path.resolve(dir).toLowerCase();
+    if (process.platform === 'win32') {
+        const windir = (process.env.SystemRoot || 'C:\\Windows').toLowerCase();
+        return normalized === windir || normalized.startsWith(`${windir}${path.sep}`) || /^[a-z]:\\$/.test(normalized);
+    }
+    return normalized === '/' || ['/usr', '/bin', '/sbin', '/etc', '/var'].some(root => normalized === root || normalized.startsWith(`${root}/`));
+}
 /** Dot-dirs that hold a client's project config; the real project root is their parent. */
 const CONFIG_DOT_DIRS = new Set(['.cursor', '.claude', '.codex', '.vscode', '.gemini', '.kiro']);
 /** Map discovered project config file paths back to their owning project folders. */
@@ -797,7 +806,12 @@ async function discoverCommand(args, config) {
         }
         return;
     }
-    const cwd = process.cwd();
+    // Scheduled tasks and the daemon run with cwd=C:\WINDOWS\system32 (or "/" on
+    // POSIX). Scanning "the current project folder" from an OS directory is
+    // meaningless and confusing in the dashboard scan-scope report — fall back to
+    // the user's home, which is where all the AI-dev roots we scan live anyway.
+    const rawCwd = process.cwd();
+    const cwd = isOsSystemFolder(rawCwd) ? os.homedir() : rawCwd;
     const runMcp = surfaces.has('mcp');
     const scanned = [];
     let found = [];
@@ -882,7 +896,9 @@ async function discoverCommand(args, config) {
             workingDirectory: cwd,
             mcpConfigPaths: scanned.map(s => ({ ...s, exists: fs.existsSync(s.path) })),
             included: [
-                `Current command folder: ${cwd}`,
+                cwd === rawCwd
+                    ? `Current command folder: ${cwd}`
+                    : `User home folder: ${cwd} (scan started by the background daemon/scheduler)`,
                 'Known MCP/AI client config files for Cursor, Claude, Codex, Gemini, Windsurf, and VS Code',
                 `User-level AI rules, skills, hooks, and instruction files under ${home}`,
                 `Credential stores and shell history under ${home}`,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.7"
+  "version": "1.15.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.7",
+  "version": "1.15.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {