fullcourtdefense-cli 1.15.7 → 1.15.9

package/dist/commands/daemon.js

@@ -135,9 +135,14 @@ function logFile() {
 /** Spawn `discover --upload --surface all --silent` and wait for it to finish. */
 function runDiscoverSweep(timeoutMs = 300_000) {
     return new Promise((resolve, reject) => {
-        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
+        // --scan-root auto sweeps the default dev roots; admin-selected folders from
+        // the console are merged in by discover itself (cached runtime bundle).
+        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent', '--scan-root', 'auto'], {
             windowsHide: true,
             stdio: 'ignore',
+            // Daemon/scheduled-task cwd is C:\WINDOWS\system32 — scan from the user's
+            // home so the posture scope reports a meaningful folder, not an OS dir.
+            cwd: os.homedir(),
         });
         const timer = setTimeout(() => {
             child.kill();

package/dist/commands/discover.js

@@ -45,6 +45,7 @@ const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const discoverPaths_1 = require("./discoverPaths");
+const runtimeConfig_1 = require("../runtimeConfig");
 const knownMcpServers_1 = require("./knownMcpServers");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverBlastRadius_1 = require("./discoverBlastRadius");
@@ -123,6 +124,15 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
 function candidateConfigPaths(cwd, extra) {
     return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
+/** True when a path is an operating-system folder (daemon/scheduled-task cwd), never a real project. */
+function isOsSystemFolder(dir) {
+    const normalized = path.resolve(dir).toLowerCase();
+    if (process.platform === 'win32') {
+        const windir = (process.env.SystemRoot || 'C:\\Windows').toLowerCase();
+        return normalized === windir || normalized.startsWith(`${windir}${path.sep}`) || /^[a-z]:\\$/.test(normalized);
+    }
+    return normalized === '/' || ['/usr', '/bin', '/sbin', '/etc', '/var'].some(root => normalized === root || normalized.startsWith(`${root}/`));
+}
 /** Dot-dirs that hold a client's project config; the real project root is their parent. */
 const CONFIG_DOT_DIRS = new Set(['.cursor', '.claude', '.codex', '.vscode', '.gemini', '.kiro']);
 /** Map discovered project config file paths back to their owning project folders. */
@@ -797,7 +807,12 @@ async function discoverCommand(args, config) {
         }
         return;
     }
-    const cwd = process.cwd();
+    // Scheduled tasks and the daemon run with cwd=C:\WINDOWS\system32 (or "/" on
+    // POSIX). Scanning "the current project folder" from an OS directory is
+    // meaningless and confusing in the dashboard scan-scope report — fall back to
+    // the user's home, which is where all the AI-dev roots we scan live anyway.
+    const rawCwd = process.cwd();
+    const cwd = isOsSystemFolder(rawCwd) ? os.homedir() : rawCwd;
     const runMcp = surfaces.has('mcp');
     const scanned = [];
     let found = [];
@@ -807,9 +822,14 @@ async function discoverCommand(args, config) {
     // Computed once and shared across MCP, secrets, and agent-file scans so the
     // whole posture references every mapped folder. Without the flag it is empty
     // and behavior is exactly the known-locations scan.
-    const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
+    // Admin-chosen folders (picked in the console per machine, delivered via the
+    // runtime bundle) are always merged in, so every scheduled/daemon/manual scan
+    // covers them without extra flags.
+    const adminScanRoots = (0, runtimeConfig_1.getCachedExtraScanRoots)();
+    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])];
     const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
-    const sweepProjectRoots = deriveProjectRoots(sweep.candidates);
+    // Admin roots are scanned for env/secrets even when no MCP config lives there.
+    const sweepProjectRoots = [...new Set([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])];
     const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath);
     const secretConfigFiles = [...knownConfigCandidates, ...sweep.candidates]
         .map(candidate => path.resolve(candidate.path))
@@ -872,6 +892,22 @@ async function discoverCommand(args, config) {
         : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     const home = os.homedir();
+    // Effective roots the posture scan covered — proof of coverage for the console.
+    const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
+        .map(root => path.resolve(root));
+    const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
+    const scannedRoots = [
+        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'default' })),
+        ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
+        ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
+            .map(root => path.resolve(root))
+            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()))
+            .map(root => ({ path: root, source: 'default' })),
+    ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
+    // Shallow folder tree for the console folder picker (names only, no contents).
+    const folderCatalog = surfaces.has('posture') || surfaces.has('secrets')
+        ? (0, discoverPaths_1.buildFolderCatalog)({ extraRoots: adminScanRoots })
+        : undefined;
     const uploadExtras = {
         secrets,
         agentFiles,
@@ -881,19 +917,24 @@ async function discoverCommand(args, config) {
             surfaces: [...surfaces],
             workingDirectory: cwd,
             mcpConfigPaths: scanned.map(s => ({ ...s, exists: fs.existsSync(s.path) })),
+            scannedRoots,
+            folderCatalog,
             included: [
-                `Current command folder: ${cwd}`,
+                cwd === rawCwd
+                    ? `Current command folder: ${cwd}`
+                    : `User home folder: ${cwd} (scan started by the background daemon/scheduler)`,
                 'Known MCP/AI client config files for Cursor, Claude, Codex, Gemini, Windsurf, and VS Code',
                 `User-level AI rules, skills, hooks, and instruction files under ${home}`,
                 `Credential stores and shell history under ${home}`,
                 `Environment files under ${cwd}, ${path.join(home, 'dev')}, ${path.join(home, 'repos')}, ${path.join(home, 'projects')}, ${path.join(home, 'Documents')}, and ${path.join(home, 'code')}`,
+                ...adminScanRoots.map(root => `Admin-selected folder: ${root} (and subfolders)`),
             ],
             excluded: [
                 'Unrelated project folders outside the listed roots',
                 'Large/generated dependency and build folders such as node_modules, .git, dist, build, vendor, caches, and temp folders',
                 'Full disk contents, browser profiles, email/chat archives, binary files, and operating-system folders',
             ],
-            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Run the command from the project folder you want represented.',
+            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Add folders from the machine page to expand coverage.',
         },
     };
     async function maybeUpload() {

package/dist/commands/discoverPaths.d.ts

@@ -29,6 +29,25 @@ export declare function scanRootsForProjectConfigs(roots: string[], options?: {
     candidates: ConfigPathCandidate[];
     scannedDirs: number;
 };
+export interface FolderCatalogEntry {
+    path: string;
+    /** Depth relative to its walk root (home or a dev root) — lets the UI indent. */
+    depth: number;
+    /** True when the folder has at least one visible subfolder (UI shows an expander). */
+    hasChildren: boolean;
+}
+/**
+ * Shallow, bounded folder tree of the machine for the console folder picker:
+ * the user home plus every default dev root, walked a few levels deep, names
+ * only. The admin expands this tree in the dashboard and picks folders to add
+ * to the posture scan — so the picker always reflects the machine's REAL
+ * structure without uploading anything sensitive (no files, no contents).
+ */
+export declare function buildFolderCatalog(options?: {
+    maxDepth?: number;
+    maxEntries?: number;
+    extraRoots?: string[];
+}): FolderCatalogEntry[];
 /** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
 export declare function resolveScanRoots(flag: string | undefined): string[];
 /** Include config paths for apps that exist on disk even when the MCP file is not created yet. */

package/dist/commands/discoverPaths.js

@@ -40,6 +40,7 @@ exports.claudeDesktopInstallTargets = claudeDesktopInstallTargets;
 exports.candidateConfigPaths = candidateConfigPaths;
 exports.defaultScanRoots = defaultScanRoots;
 exports.scanRootsForProjectConfigs = scanRootsForProjectConfigs;
+exports.buildFolderCatalog = buildFolderCatalog;
 exports.resolveScanRoots = resolveScanRoots;
 exports.discoverScanTargets = discoverScanTargets;
 const fs = __importStar(require("fs"));
@@ -281,6 +282,79 @@ function scanRootsForProjectConfigs(roots, options = {}) {
     }
     return { candidates, scannedDirs };
 }
+/** Non-dev home folders that only add noise to the console folder picker. */
+const CATALOG_SKIP_HOME_DIRS = new Set([
+    'appdata', 'application data', 'local settings', 'cookies', 'nethood', 'printhood',
+    'recent', 'sendto', 'start menu', 'templates', 'searches', 'links', 'saved games',
+    '3d objects', 'contacts', 'favorites', 'music', 'videos', 'pictures', 'library',
+    'movies', 'public',
+]);
+/**
+ * Shallow, bounded folder tree of the machine for the console folder picker:
+ * the user home plus every default dev root, walked a few levels deep, names
+ * only. The admin expands this tree in the dashboard and picks folders to add
+ * to the posture scan — so the picker always reflects the machine's REAL
+ * structure without uploading anything sensitive (no files, no contents).
+ */
+function buildFolderCatalog(options = {}) {
+    const maxDepth = options.maxDepth ?? 3;
+    const maxEntries = options.maxEntries ?? 600;
+    const home = os.homedir();
+    const entries = [];
+    const seen = new Set();
+    const listVisibleSubdirs = (dir, atHomeLevel) => {
+        let dirents;
+        try {
+            dirents = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return [];
+        }
+        return dirents
+            .filter(entry => {
+            if (!entry.isDirectory())
+                return false;
+            const name = entry.name.toLowerCase();
+            if (entry.name.startsWith('.') || entry.name.startsWith('$'))
+                return false;
+            if (SCAN_SKIP_DIRS.has(name))
+                return false;
+            if (atHomeLevel && CATALOG_SKIP_HOME_DIRS.has(name))
+                return false;
+            return true;
+        })
+            .map(entry => path.join(dir, entry.name));
+    };
+    const walk = (root) => {
+        const queue = [{ dir: root, depth: 0 }];
+        while (queue.length > 0 && entries.length < maxEntries) {
+            const { dir, depth } = queue.shift();
+            const key = path.resolve(dir).toLowerCase();
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const children = listVisibleSubdirs(dir, key === home.toLowerCase());
+            entries.push({ path: path.resolve(dir), depth, hasChildren: children.length > 0 });
+            if (depth < maxDepth) {
+                for (const child of children)
+                    queue.push({ dir: child, depth: depth + 1 });
+            }
+        }
+    };
+    walk(home);
+    for (const root of defaultScanRoots())
+        walk(root);
+    // Admin-chosen folders get catalogued too, so the picker tree keeps expanding
+    // beneath paths the admin already selected.
+    for (const root of options.extraRoots || []) {
+        try {
+            if (fs.statSync(root).isDirectory())
+                walk(root);
+        }
+        catch { /* folder removed since selection — skip */ }
+    }
+    return entries;
+}
 /** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
 function resolveScanRoots(flag) {
     if (!flag?.trim())

package/dist/commands/discoverSecrets.js

@@ -199,6 +199,28 @@ function scanCredentialStorePosture(filePath, content, category, out, seen) {
             detail: '.netrc contains machine login/password material used by CLI tools.',
         });
     }
+    if (normalized.endsWith('/.git-credentials') && /https?:\/\/[^:\s/]+:[^@\s]+@/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'git',
+            severity: 'high',
+            title: 'Git credentials stored in plaintext',
+            detail: '.git-credentials stores repository usernames/tokens unencrypted — anything on this machine (including AI agents) can read and reuse them.',
+            remediation: 'Switch to `git config --global credential.helper manager` (Windows/mac keychain) or `cache`, then delete ~/.git-credentials and rotate the exposed tokens.',
+        });
+    }
+    if (normalized.endsWith('/.gitconfig') && /helper\s*=\s*store\b/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'git',
+            severity: 'medium',
+            title: 'Git credential helper set to plaintext "store"',
+            detail: 'credential.helper=store writes every git password/token to ~/.git-credentials in plaintext.',
+            remediation: 'Use the OS keychain helper instead: `git config --global credential.helper manager` (Windows) / `osxkeychain` (mac) / `libsecret` (Linux).',
+        });
+    }
     if (normalized.endsWith('/.pypirc') && /\b(?:password|token)\s*=\s*\S+/i.test(content)) {
         pushStoreFinding(out, seen, {
             filePath,
@@ -317,6 +339,14 @@ function credentialStores(home) {
     const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
     return [
         { path: path.join(home, '.aws', 'credentials'), category: 'credential_store', title: 'AWS credentials file' },
+        { path: path.join(home, '.git-credentials'), category: 'credential_store', title: 'Git plaintext credentials' },
+        { path: path.join(home, '.gitconfig'), category: 'credential_store', title: 'Git config' },
+        { path: path.join(appData, 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings' },
+        { path: path.join(appData, 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings' },
+        { path: path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings (mac)' },
+        { path: path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings (mac)' },
+        { path: path.join(xdg, 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings (linux)' },
+        { path: path.join(xdg, 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings (linux)' },
         { path: path.join(home, '.docker', 'config.json'), category: 'credential_store', title: 'Docker registry auth' },
         { path: path.join(home, '.npmrc'), category: 'credential_store', title: 'npm auth token' },
         { path: path.join(home, '.pypirc'), category: 'credential_store', title: 'PyPI auth token' },

package/dist/runtimeConfig.d.ts

@@ -24,6 +24,8 @@ export interface RuntimeBundle {
     failClosed?: boolean;
     /** Admin kill-switch: while true, hooks and the gateway deny ALL actions. */
     suspended?: boolean;
+    /** Admin-chosen extra posture scan folders for this machine (from the console). */
+    extraScanRoots?: string[];
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;
@@ -55,3 +57,9 @@ export interface EffectiveBundle extends RuntimeBundle {
  * or a 'default' marker so the caller can apply its local fallback.
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
+/**
+ * Admin-chosen extra posture scan folders from the most recent cached bundle
+ * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
+ * scans include console-selected folders without needing credentials plumbed in.
+ */
+export declare function getCachedExtraScanRoots(): string[];

package/dist/runtimeConfig.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -70,7 +71,7 @@ async function getRuntimeBundle(input) {
     const cached = cache[input.shieldId];
     const fresh = cached && Date.now() - cached.fetchedAt < ttl;
     if (cached && fresh && !input.force) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
     }
     try {
         const headers = { 'Content-Type': 'application/json' };
@@ -90,7 +91,7 @@ async function getRuntimeBundle(input) {
         if (resp.status === 304 && cached) {
             cache[input.shieldId] = { ...cached, fetchedAt: Date.now() };
             writeCacheFile(cache);
-            return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+            return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
         }
         if (resp.ok) {
             const body = await resp.json().catch(() => ({}));
@@ -103,6 +104,9 @@ async function getRuntimeBundle(input) {
                     pollIntervalMs: body.data.pollIntervalMs,
                     failClosed: typeof body.data.failClosed === 'boolean' ? body.data.failClosed : undefined,
                     suspended: body.data.suspended === true,
+                    extraScanRoots: Array.isArray(body.data.extraScanRoots)
+                        ? body.data.extraScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
+                        : undefined,
                     machineAction: body.data.machineAction,
                     fetchedAt: Date.now(),
                 };
@@ -114,7 +118,23 @@ async function getRuntimeBundle(input) {
     }
     catch { /* fall through to cache / default */ }
     if (cached) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
     }
     return { mode: 'block', version: '', source: 'default' };
 }
+/**
+ * Admin-chosen extra posture scan folders from the most recent cached bundle
+ * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
+ * scans include console-selected folders without needing credentials plumbed in.
+ */
+function getCachedExtraScanRoots() {
+    const cache = readCacheFile();
+    const roots = new Set();
+    for (const entry of Object.values(cache)) {
+        for (const root of entry.extraScanRoots || []) {
+            if (typeof root === 'string' && root.trim())
+                roots.add(root.trim());
+        }
+    }
+    return [...roots];
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.7"
+  "version": "1.15.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.7",
+  "version": "1.15.9",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {