fullcourtdefense-cli 1.15.8 → 1.15.10

package/dist/commands/daemon.js

@@ -135,7 +135,9 @@ function logFile() {
 /** Spawn `discover --upload --surface all --silent` and wait for it to finish. */
 function runDiscoverSweep(timeoutMs = 300_000) {
     return new Promise((resolve, reject) => {
-        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent'], {
+        // --scan-root auto sweeps the default dev roots; admin-selected folders from
+        // the console are merged in by discover itself (cached runtime bundle).
+        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent', '--scan-root', 'auto'], {
             windowsHide: true,
             stdio: 'ignore',
             // Daemon/scheduled-task cwd is C:\WINDOWS\system32 — scan from the user's

package/dist/commands/discover.js

@@ -45,6 +45,7 @@ const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const discoverPaths_1 = require("./discoverPaths");
+const runtimeConfig_1 = require("../runtimeConfig");
 const knownMcpServers_1 = require("./knownMcpServers");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverBlastRadius_1 = require("./discoverBlastRadius");
@@ -821,9 +822,18 @@ async function discoverCommand(args, config) {
     // Computed once and shared across MCP, secrets, and agent-file scans so the
     // whole posture references every mapped folder. Without the flag it is empty
     // and behavior is exactly the known-locations scan.
-    const scanRoots = (0, discoverPaths_1.resolveScanRoots)(args.scanRoot);
+    // Admin-chosen folders (picked in the console per machine, delivered via the
+    // runtime bundle) are always merged in, so every scheduled/daemon/manual scan
+    // covers them without extra flags. Default folders the admin explicitly
+    // removed in the console are dropped from the sweep.
+    const { extraScanRoots: adminScanRoots, disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
+    const disabledRootSet = new Set(disabledScanRoots.map(root => path.resolve(root).toLowerCase()));
+    const isDisabledRoot = (root) => disabledRootSet.has(path.resolve(root).toLowerCase());
+    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])]
+        .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
-    const sweepProjectRoots = deriveProjectRoots(sweep.candidates);
+    // Admin roots are scanned for env/secrets even when no MCP config lives there.
+    const sweepProjectRoots = [...new Set([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])];
     const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath);
     const secretConfigFiles = [...knownConfigCandidates, ...sweep.candidates]
         .map(candidate => path.resolve(candidate.path))
@@ -871,7 +881,7 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, configFiles: secretConfigFiles })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, disabledRoots: disabledScanRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
         ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd, extraRoots: sweepProjectRoots })
@@ -886,6 +896,23 @@ async function discoverCommand(args, config) {
         : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     const home = os.homedir();
+    // Effective roots the posture scan covered — proof of coverage for the console.
+    // Admin-removed defaults are excluded here too, so the console mirrors reality.
+    const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
+        .map(root => path.resolve(root));
+    const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
+    const scannedRoots = [
+        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root) && !isDisabledRoot(root)).map(root => ({ path: root, source: 'default' })),
+        ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
+        ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
+            .map(root => path.resolve(root))
+            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()) && !isDisabledRoot(root))
+            .map(root => ({ path: root, source: 'default' })),
+    ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
+    // Shallow folder tree for the console folder picker (names only, no contents).
+    const folderCatalog = surfaces.has('posture') || surfaces.has('secrets')
+        ? (0, discoverPaths_1.buildFolderCatalog)({ extraRoots: adminScanRoots })
+        : undefined;
     const uploadExtras = {
         secrets,
         agentFiles,
@@ -895,6 +922,8 @@ async function discoverCommand(args, config) {
             surfaces: [...surfaces],
             workingDirectory: cwd,
             mcpConfigPaths: scanned.map(s => ({ ...s, exists: fs.existsSync(s.path) })),
+            scannedRoots,
+            folderCatalog,
             included: [
                 cwd === rawCwd
                     ? `Current command folder: ${cwd}`
@@ -903,13 +932,14 @@ async function discoverCommand(args, config) {
                 `User-level AI rules, skills, hooks, and instruction files under ${home}`,
                 `Credential stores and shell history under ${home}`,
                 `Environment files under ${cwd}, ${path.join(home, 'dev')}, ${path.join(home, 'repos')}, ${path.join(home, 'projects')}, ${path.join(home, 'Documents')}, and ${path.join(home, 'code')}`,
+                ...adminScanRoots.map(root => `Admin-selected folder: ${root} (and subfolders)`),
             ],
             excluded: [
                 'Unrelated project folders outside the listed roots',
                 'Large/generated dependency and build folders such as node_modules, .git, dist, build, vendor, caches, and temp folders',
                 'Full disk contents, browser profiles, email/chat archives, binary files, and operating-system folders',
             ],
-            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Run the command from the project folder you want represented.',
+            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Add folders from the machine page to expand coverage.',
         },
     };
     async function maybeUpload() {

package/dist/commands/discoverPaths.d.ts

@@ -29,6 +29,25 @@ export declare function scanRootsForProjectConfigs(roots: string[], options?: {
     candidates: ConfigPathCandidate[];
     scannedDirs: number;
 };
+export interface FolderCatalogEntry {
+    path: string;
+    /** Depth relative to its walk root (home or a dev root) — lets the UI indent. */
+    depth: number;
+    /** True when the folder has at least one visible subfolder (UI shows an expander). */
+    hasChildren: boolean;
+}
+/**
+ * Shallow, bounded folder tree of the machine for the console folder picker:
+ * the user home plus every default dev root, walked a few levels deep, names
+ * only. The admin expands this tree in the dashboard and picks folders to add
+ * to the posture scan — so the picker always reflects the machine's REAL
+ * structure without uploading anything sensitive (no files, no contents).
+ */
+export declare function buildFolderCatalog(options?: {
+    maxDepth?: number;
+    maxEntries?: number;
+    extraRoots?: string[];
+}): FolderCatalogEntry[];
 /** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
 export declare function resolveScanRoots(flag: string | undefined): string[];
 /** Include config paths for apps that exist on disk even when the MCP file is not created yet. */

package/dist/commands/discoverPaths.js

@@ -40,6 +40,7 @@ exports.claudeDesktopInstallTargets = claudeDesktopInstallTargets;
 exports.candidateConfigPaths = candidateConfigPaths;
 exports.defaultScanRoots = defaultScanRoots;
 exports.scanRootsForProjectConfigs = scanRootsForProjectConfigs;
+exports.buildFolderCatalog = buildFolderCatalog;
 exports.resolveScanRoots = resolveScanRoots;
 exports.discoverScanTargets = discoverScanTargets;
 const fs = __importStar(require("fs"));
@@ -281,6 +282,79 @@ function scanRootsForProjectConfigs(roots, options = {}) {
     }
     return { candidates, scannedDirs };
 }
+/** Non-dev home folders that only add noise to the console folder picker. */
+const CATALOG_SKIP_HOME_DIRS = new Set([
+    'appdata', 'application data', 'local settings', 'cookies', 'nethood', 'printhood',
+    'recent', 'sendto', 'start menu', 'templates', 'searches', 'links', 'saved games',
+    '3d objects', 'contacts', 'favorites', 'music', 'videos', 'pictures', 'library',
+    'movies', 'public',
+]);
+/**
+ * Shallow, bounded folder tree of the machine for the console folder picker:
+ * the user home plus every default dev root, walked a few levels deep, names
+ * only. The admin expands this tree in the dashboard and picks folders to add
+ * to the posture scan — so the picker always reflects the machine's REAL
+ * structure without uploading anything sensitive (no files, no contents).
+ */
+function buildFolderCatalog(options = {}) {
+    const maxDepth = options.maxDepth ?? 3;
+    const maxEntries = options.maxEntries ?? 600;
+    const home = os.homedir();
+    const entries = [];
+    const seen = new Set();
+    const listVisibleSubdirs = (dir, atHomeLevel) => {
+        let dirents;
+        try {
+            dirents = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return [];
+        }
+        return dirents
+            .filter(entry => {
+            if (!entry.isDirectory())
+                return false;
+            const name = entry.name.toLowerCase();
+            if (entry.name.startsWith('.') || entry.name.startsWith('$'))
+                return false;
+            if (SCAN_SKIP_DIRS.has(name))
+                return false;
+            if (atHomeLevel && CATALOG_SKIP_HOME_DIRS.has(name))
+                return false;
+            return true;
+        })
+            .map(entry => path.join(dir, entry.name));
+    };
+    const walk = (root) => {
+        const queue = [{ dir: root, depth: 0 }];
+        while (queue.length > 0 && entries.length < maxEntries) {
+            const { dir, depth } = queue.shift();
+            const key = path.resolve(dir).toLowerCase();
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const children = listVisibleSubdirs(dir, key === home.toLowerCase());
+            entries.push({ path: path.resolve(dir), depth, hasChildren: children.length > 0 });
+            if (depth < maxDepth) {
+                for (const child of children)
+                    queue.push({ dir: child, depth: depth + 1 });
+            }
+        }
+    };
+    walk(home);
+    for (const root of defaultScanRoots())
+        walk(root);
+    // Admin-chosen folders get catalogued too, so the picker tree keeps expanding
+    // beneath paths the admin already selected.
+    for (const root of options.extraRoots || []) {
+        try {
+            if (fs.statSync(root).isDirectory())
+                walk(root);
+        }
+        catch { /* folder removed since selection — skip */ }
+    }
+    return entries;
+}
 /** Resolve the --scan-root flag: comma-separated paths, or "auto" for common dev folders. */
 function resolveScanRoots(flag) {
     if (!flag?.trim())

package/dist/commands/discoverSecrets.d.ts

@@ -22,5 +22,6 @@ export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
     extraRoots?: string[];
+    disabledRoots?: string[];
     configFiles?: string[];
 }): SecretsScanResult;

package/dist/commands/discoverSecrets.js

@@ -199,6 +199,28 @@ function scanCredentialStorePosture(filePath, content, category, out, seen) {
             detail: '.netrc contains machine login/password material used by CLI tools.',
         });
     }
+    if (normalized.endsWith('/.git-credentials') && /https?:\/\/[^:\s/]+:[^@\s]+@/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'git',
+            severity: 'high',
+            title: 'Git credentials stored in plaintext',
+            detail: '.git-credentials stores repository usernames/tokens unencrypted — anything on this machine (including AI agents) can read and reuse them.',
+            remediation: 'Switch to `git config --global credential.helper manager` (Windows/mac keychain) or `cache`, then delete ~/.git-credentials and rotate the exposed tokens.',
+        });
+    }
+    if (normalized.endsWith('/.gitconfig') && /helper\s*=\s*store\b/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'git',
+            severity: 'medium',
+            title: 'Git credential helper set to plaintext "store"',
+            detail: 'credential.helper=store writes every git password/token to ~/.git-credentials in plaintext.',
+            remediation: 'Use the OS keychain helper instead: `git config --global credential.helper manager` (Windows) / `osxkeychain` (mac) / `libsecret` (Linux).',
+        });
+    }
     if (normalized.endsWith('/.pypirc') && /\b(?:password|token)\s*=\s*\S+/i.test(content)) {
         pushStoreFinding(out, seen, {
             filePath,
@@ -317,6 +339,14 @@ function credentialStores(home) {
     const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
     return [
         { path: path.join(home, '.aws', 'credentials'), category: 'credential_store', title: 'AWS credentials file' },
+        { path: path.join(home, '.git-credentials'), category: 'credential_store', title: 'Git plaintext credentials' },
+        { path: path.join(home, '.gitconfig'), category: 'credential_store', title: 'Git config' },
+        { path: path.join(appData, 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings' },
+        { path: path.join(appData, 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings' },
+        { path: path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings (mac)' },
+        { path: path.join(home, 'Library', 'Application Support', 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings (mac)' },
+        { path: path.join(xdg, 'Code', 'User', 'settings.json'), category: 'credential_store', title: 'VS Code user settings (linux)' },
+        { path: path.join(xdg, 'Cursor', 'User', 'settings.json'), category: 'credential_store', title: 'Cursor user settings (linux)' },
         { path: path.join(home, '.docker', 'config.json'), category: 'credential_store', title: 'Docker registry auth' },
         { path: path.join(home, '.npmrc'), category: 'credential_store', title: 'npm auth token' },
         { path: path.join(home, '.pypirc'), category: 'credential_store', title: 'PyPI auth token' },
@@ -448,7 +478,8 @@ function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
     const maxDepth = options.maxEnvDepth ?? 4;
-    const extraRoots = options.extraRoots ?? [];
+    const disabledRoots = new Set((options.disabledRoots ?? []).map(root => path.resolve(root).toLowerCase()));
+    const extraRoots = (options.extraRoots ?? []).filter(root => !disabledRoots.has(path.resolve(root).toLowerCase()));
     const findings = [];
     const seen = new Set();
     let scannedFiles = 0;
@@ -483,7 +514,7 @@ function scanSecrets(options = {}) {
         path.join(home, 'projects'),
         path.join(home, 'Documents'),
         path.join(home, 'code'),
-    ].filter(root => fs.existsSync(root))));
+    ].filter(root => fs.existsSync(root) && !disabledRoots.has(path.resolve(root).toLowerCase()))));
     for (const envFile of collectEnvFiles(envRoots, maxDepth)) {
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/runtimeConfig.d.ts

@@ -24,6 +24,10 @@ export interface RuntimeBundle {
     failClosed?: boolean;
     /** Admin kill-switch: while true, hooks and the gateway deny ALL actions. */
     suspended?: boolean;
+    /** Admin-chosen extra posture scan folders for this machine (from the console). */
+    extraScanRoots?: string[];
+    /** Default scan folders the admin explicitly removed from this machine's posture sweep. */
+    disabledScanRoots?: string[];
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;
@@ -55,3 +59,15 @@ export interface EffectiveBundle extends RuntimeBundle {
  * or a 'default' marker so the caller can apply its local fallback.
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
+/**
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
+ */
+export declare function getCachedScanRootOverrides(): {
+    extraScanRoots: string[];
+    disabledScanRoots: string[];
+};
+/** @deprecated Use getCachedScanRootOverrides(). */
+export declare function getCachedExtraScanRoots(): string[];

package/dist/runtimeConfig.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
+exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -70,7 +72,7 @@ async function getRuntimeBundle(input) {
     const cached = cache[input.shieldId];
     const fresh = cached && Date.now() - cached.fetchedAt < ttl;
     if (cached && fresh && !input.force) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
     }
     try {
         const headers = { 'Content-Type': 'application/json' };
@@ -90,7 +92,7 @@ async function getRuntimeBundle(input) {
         if (resp.status === 304 && cached) {
             cache[input.shieldId] = { ...cached, fetchedAt: Date.now() };
             writeCacheFile(cache);
-            return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+            return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
         }
         if (resp.ok) {
             const body = await resp.json().catch(() => ({}));
@@ -103,6 +105,12 @@ async function getRuntimeBundle(input) {
                     pollIntervalMs: body.data.pollIntervalMs,
                     failClosed: typeof body.data.failClosed === 'boolean' ? body.data.failClosed : undefined,
                     suspended: body.data.suspended === true,
+                    extraScanRoots: Array.isArray(body.data.extraScanRoots)
+                        ? body.data.extraScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
+                        : undefined,
+                    disabledScanRoots: Array.isArray(body.data.disabledScanRoots)
+                        ? body.data.disabledScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
+                        : undefined,
                     machineAction: body.data.machineAction,
                     fetchedAt: Date.now(),
                 };
@@ -114,7 +122,33 @@ async function getRuntimeBundle(input) {
     }
     catch { /* fall through to cache / default */ }
     if (cached) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, machineAction: cached.machineAction, source: 'cache' };
+        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, machineAction: cached.machineAction, source: 'cache' };
     }
     return { mode: 'block', version: '', source: 'default' };
 }
+/**
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
+ */
+function getCachedScanRootOverrides() {
+    const cache = readCacheFile();
+    const extra = new Set();
+    const disabled = new Set();
+    for (const entry of Object.values(cache)) {
+        for (const root of entry.extraScanRoots || []) {
+            if (typeof root === 'string' && root.trim())
+                extra.add(root.trim());
+        }
+        for (const root of entry.disabledScanRoots || []) {
+            if (typeof root === 'string' && root.trim())
+                disabled.add(root.trim());
+        }
+    }
+    return { extraScanRoots: [...extra], disabledScanRoots: [...disabled] };
+}
+/** @deprecated Use getCachedScanRootOverrides(). */
+function getCachedExtraScanRoots() {
+    return getCachedScanRootOverrides().extraScanRoots;
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.8"
+  "version": "1.15.10"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.8",
+  "version": "1.15.10",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {