fullcourtdefense-cli 1.15.9 → 1.15.10

package/dist/commands/discover.js

@@ -824,9 +824,13 @@ async function discoverCommand(args, config) {
     // and behavior is exactly the known-locations scan.
     // Admin-chosen folders (picked in the console per machine, delivered via the
     // runtime bundle) are always merged in, so every scheduled/daemon/manual scan
-    // covers them without extra flags.
-    const adminScanRoots = (0, runtimeConfig_1.getCachedExtraScanRoots)();
-    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])];
+    // covers them without extra flags. Default folders the admin explicitly
+    // removed in the console are dropped from the sweep.
+    const { extraScanRoots: adminScanRoots, disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
+    const disabledRootSet = new Set(disabledScanRoots.map(root => path.resolve(root).toLowerCase()));
+    const isDisabledRoot = (root) => disabledRootSet.has(path.resolve(root).toLowerCase());
+    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])]
+        .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
     // Admin roots are scanned for env/secrets even when no MCP config lives there.
     const sweepProjectRoots = [...new Set([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])];
@@ -877,7 +881,7 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, configFiles: secretConfigFiles })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, disabledRoots: disabledScanRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
         ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd, extraRoots: sweepProjectRoots })
@@ -893,15 +897,16 @@ async function discoverCommand(args, config) {
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     const home = os.homedir();
     // Effective roots the posture scan covered — proof of coverage for the console.
+    // Admin-removed defaults are excluded here too, so the console mirrors reality.
     const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
         .map(root => path.resolve(root));
     const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
     const scannedRoots = [
-        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'default' })),
+        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root) && !isDisabledRoot(root)).map(root => ({ path: root, source: 'default' })),
         ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
         ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
             .map(root => path.resolve(root))
-            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()))
+            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()) && !isDisabledRoot(root))
             .map(root => ({ path: root, source: 'default' })),
     ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
     // Shallow folder tree for the console folder picker (names only, no contents).

package/dist/commands/discoverSecrets.d.ts

@@ -22,5 +22,6 @@ export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
     extraRoots?: string[];
+    disabledRoots?: string[];
     configFiles?: string[];
 }): SecretsScanResult;

package/dist/commands/discoverSecrets.js

@@ -478,7 +478,8 @@ function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
     const maxDepth = options.maxEnvDepth ?? 4;
-    const extraRoots = options.extraRoots ?? [];
+    const disabledRoots = new Set((options.disabledRoots ?? []).map(root => path.resolve(root).toLowerCase()));
+    const extraRoots = (options.extraRoots ?? []).filter(root => !disabledRoots.has(path.resolve(root).toLowerCase()));
     const findings = [];
     const seen = new Set();
     let scannedFiles = 0;
@@ -513,7 +514,7 @@ function scanSecrets(options = {}) {
         path.join(home, 'projects'),
         path.join(home, 'Documents'),
         path.join(home, 'code'),
-    ].filter(root => fs.existsSync(root))));
+    ].filter(root => fs.existsSync(root) && !disabledRoots.has(path.resolve(root).toLowerCase()))));
     for (const envFile of collectEnvFiles(envRoots, maxDepth)) {
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/runtimeConfig.d.ts

@@ -26,6 +26,8 @@ export interface RuntimeBundle {
     suspended?: boolean;
     /** Admin-chosen extra posture scan folders for this machine (from the console). */
     extraScanRoots?: string[];
+    /** Default scan folders the admin explicitly removed from this machine's posture sweep. */
+    disabledScanRoots?: string[];
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;
@@ -58,8 +60,14 @@ export interface EffectiveBundle extends RuntimeBundle {
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
 /**
- * Admin-chosen extra posture scan folders from the most recent cached bundle
- * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
- * scans include console-selected folders without needing credentials plumbed in.
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
  */
+export declare function getCachedScanRootOverrides(): {
+    extraScanRoots: string[];
+    disabledScanRoots: string[];
+};
+/** @deprecated Use getCachedScanRootOverrides(). */
 export declare function getCachedExtraScanRoots(): string[];

package/dist/runtimeConfig.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -107,6 +108,9 @@ async function getRuntimeBundle(input) {
                     extraScanRoots: Array.isArray(body.data.extraScanRoots)
                         ? body.data.extraScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
                         : undefined,
+                    disabledScanRoots: Array.isArray(body.data.disabledScanRoots)
+                        ? body.data.disabledScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
+                        : undefined,
                     machineAction: body.data.machineAction,
                     fetchedAt: Date.now(),
                 };
@@ -123,18 +127,28 @@ async function getRuntimeBundle(input) {
     return { mode: 'block', version: '', source: 'default' };
 }
 /**
- * Admin-chosen extra posture scan folders from the most recent cached bundle
- * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
- * scans include console-selected folders without needing credentials plumbed in.
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
  */
-function getCachedExtraScanRoots() {
+function getCachedScanRootOverrides() {
     const cache = readCacheFile();
-    const roots = new Set();
+    const extra = new Set();
+    const disabled = new Set();
     for (const entry of Object.values(cache)) {
         for (const root of entry.extraScanRoots || []) {
             if (typeof root === 'string' && root.trim())
-                roots.add(root.trim());
+                extra.add(root.trim());
+        }
+        for (const root of entry.disabledScanRoots || []) {
+            if (typeof root === 'string' && root.trim())
+                disabled.add(root.trim());
         }
     }
-    return [...roots];
+    return { extraScanRoots: [...extra], disabledScanRoots: [...disabled] };
+}
+/** @deprecated Use getCachedScanRootOverrides(). */
+function getCachedExtraScanRoots() {
+    return getCachedScanRootOverrides().extraScanRoots;
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.9"
+  "version": "1.15.10"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.9",
+  "version": "1.15.10",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {