fullcourtdefense-cli 1.15.9 → 1.15.11

package/dist/commands/daemon.js

@@ -53,6 +53,7 @@ const COLOR = {
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
 };
 const TASK_NAME = 'FullCourtDefense Daemon';
+const WATCHDOG_TASK_NAME = 'FullCourtDefense Daemon Watchdog';
 const CRON_MARKER = '# FCD_DAEMON';
 const LAUNCHD_LABEL = 'ai.fullcourtdefense.daemon';
 const SYSTEMD_UNIT = 'fullcourtdefense-daemon.service';
@@ -262,6 +263,16 @@ async function runDaemon(args, config) {
         console.log(`${COLOR.yellow}Another FullCourtDefense daemon is already running (pid file: ${pidFile()}).${COLOR.reset}`);
         return;
     }
+    // The resident loop must never die silently from one bad tick (fs watcher
+    // callback, fetch, timer). Log and keep running — the loop is timer-driven,
+    // so surviving a failed tick is safe, and on Windows there is no supervisor
+    // that would restart a crashed process instantly.
+    process.on('uncaughtException', error => {
+        log(`Uncaught exception (daemon continues): ${error?.stack || String(error)}`);
+    });
+    process.on('unhandledRejection', reason => {
+        log(`Unhandled rejection (daemon continues): ${reason?.stack || String(reason)}`);
+    });
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
@@ -696,12 +707,23 @@ function installWindows() {
         ], { stdio: 'ignore', windowsHide: true });
         ok = reg.status === 0;
     }
+    // Watchdog: logon triggers only START the daemon — nothing restarts it if it
+    // is killed or crashes mid-session. A time-based per-user task (no elevation
+    // needed, unlike ONLOGON) re-launches the daemon every 5 minutes;
+    // acquirePidLock() makes each tick a cheap no-op while the daemon is alive,
+    // and revives it within one tick when it is not. Best-effort: a missing
+    // watchdog never fails the install.
+    (0, child_process_1.spawnSync)('schtasks', [
+        '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
+        '/SC', 'MINUTE', '/MO', '5', '/F',
+    ], { stdio: 'ignore', windowsHide: true });
     if (ok)
         startDaemonNowWindows(vbs, taskOk);
     return ok;
 }
 function uninstallWindows() {
     const task = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
+    (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', WATCHDOG_TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     const reg = (0, child_process_1.spawnSync)('reg', ['delete', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/f'], { stdio: 'ignore', windowsHide: true });
     const vbs = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense', 'daemon.vbs');
     try {
@@ -790,11 +812,16 @@ WantedBy=default.target
             return true;
     }
     catch { /* fall back to cron */ }
-    // Fallback: cron @reboot for boxes without a systemd user session.
+    // Fallback: cron for boxes without a systemd user session. @reboot starts
+    // the daemon at boot; the 5-min line is the watchdog (pid lock makes each
+    // tick a no-op while the daemon is alive, and revives it after a kill/crash).
     const command = `"${process.execPath}" "${cliEntry()}" daemon >/dev/null 2>&1`;
     const list = (0, child_process_1.spawnSync)('crontab', ['-l'], { encoding: 'utf8' });
     const existing = (list.status === 0 ? (list.stdout || '') : '').split('\n').filter(l => l && !l.includes(CRON_MARKER));
-    const write = (0, child_process_1.spawnSync)('crontab', ['-'], { input: [...existing, `@reboot ${command} ${CRON_MARKER}`].join('\n') + '\n', encoding: 'utf8' });
+    const write = (0, child_process_1.spawnSync)('crontab', ['-'], {
+        input: [...existing, `@reboot ${command} ${CRON_MARKER}`, `*/5 * * * * ${command} ${CRON_MARKER}`].join('\n') + '\n',
+        encoding: 'utf8',
+    });
     return write.status === 0;
 }
 function uninstallLinux() {
@@ -854,6 +881,10 @@ function statusCommand() {
         else {
             console.log('  not installed — run: fullcourtdefense daemon --install true');
         }
+        const watchdog = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', WATCHDOG_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 5_000 });
+        console.log(watchdog.status === 0
+            ? `  Watchdog task "${WATCHDOG_TASK_NAME}" installed — revives a killed daemon within 5 min`
+            : `  ${COLOR.yellow}watchdog not installed${COLOR.reset} — a killed daemon stays down until next logon; re-run: fullcourtdefense daemon --install true`);
     }
     else if (process.platform === 'darwin') {
         console.log(fs.existsSync(launchdPlistPath()) ? `  launchd agent installed (${launchdPlistPath()})` : '  not installed');
@@ -897,7 +928,7 @@ async function daemonCommand(args, config) {
                 : installLinux();
         if (ok) {
             console.log(`${COLOR.green}${COLOR.bold}Daemon autostart installed.${COLOR.reset}`);
-            console.log(`${COLOR.gray}Trigger:${COLOR.reset} ${process.platform === 'win32' ? `at logon (Scheduled Task "${TASK_NAME}")` : process.platform === 'darwin' ? 'launchd (RunAtLoad + KeepAlive)' : 'systemd user unit (or @reboot cron)'}`);
+            console.log(`${COLOR.gray}Trigger:${COLOR.reset} ${process.platform === 'win32' ? `at logon (Scheduled Task "${TASK_NAME}") + 5-min watchdog ("${WATCHDOG_TASK_NAME}") that revives a killed daemon` : process.platform === 'darwin' ? 'launchd (RunAtLoad + KeepAlive)' : 'systemd user unit (or @reboot + 5-min watchdog cron)'}`);
             console.log(`${COLOR.gray}Start now:${COLOR.reset} fullcourtdefense daemon`);
             console.log(`${COLOR.gray}Status:${COLOR.reset} fullcourtdefense daemon --status true`);
             console.log(`${COLOR.gray}Remove:${COLOR.reset} fullcourtdefense daemon --uninstall true`);

package/dist/commands/discover.js

@@ -824,9 +824,13 @@ async function discoverCommand(args, config) {
     // and behavior is exactly the known-locations scan.
     // Admin-chosen folders (picked in the console per machine, delivered via the
     // runtime bundle) are always merged in, so every scheduled/daemon/manual scan
-    // covers them without extra flags.
-    const adminScanRoots = (0, runtimeConfig_1.getCachedExtraScanRoots)();
-    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])];
+    // covers them without extra flags. Default folders the admin explicitly
+    // removed in the console are dropped from the sweep.
+    const { extraScanRoots: adminScanRoots, disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
+    const disabledRootSet = new Set(disabledScanRoots.map(root => path.resolve(root).toLowerCase()));
+    const isDisabledRoot = (root) => disabledRootSet.has(path.resolve(root).toLowerCase());
+    const scanRoots = [...new Set([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])]
+        .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0 ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots) : { candidates: [], scannedDirs: 0 };
     // Admin roots are scanned for env/secrets even when no MCP config lives there.
     const sweepProjectRoots = [...new Set([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])];
@@ -877,7 +881,7 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, configFiles: secretConfigFiles })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, disabledRoots: disabledScanRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
         ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd, extraRoots: sweepProjectRoots })
@@ -893,15 +897,16 @@ async function discoverCommand(args, config) {
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     const home = os.homedir();
     // Effective roots the posture scan covered — proof of coverage for the console.
+    // Admin-removed defaults are excluded here too, so the console mirrors reality.
     const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
         .map(root => path.resolve(root));
     const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
     const scannedRoots = [
-        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'default' })),
+        ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root) && !isDisabledRoot(root)).map(root => ({ path: root, source: 'default' })),
         ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
         ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
             .map(root => path.resolve(root))
-            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()))
+            .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()) && !isDisabledRoot(root))
             .map(root => ({ path: root, source: 'default' })),
     ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
     // Shallow folder tree for the console folder picker (names only, no contents).

package/dist/commands/discoverSecrets.d.ts

@@ -22,5 +22,6 @@ export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
     extraRoots?: string[];
+    disabledRoots?: string[];
     configFiles?: string[];
 }): SecretsScanResult;

package/dist/commands/discoverSecrets.js

@@ -478,7 +478,8 @@ function scanSecrets(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
     const maxDepth = options.maxEnvDepth ?? 4;
-    const extraRoots = options.extraRoots ?? [];
+    const disabledRoots = new Set((options.disabledRoots ?? []).map(root => path.resolve(root).toLowerCase()));
+    const extraRoots = (options.extraRoots ?? []).filter(root => !disabledRoots.has(path.resolve(root).toLowerCase()));
     const findings = [];
     const seen = new Set();
     let scannedFiles = 0;
@@ -513,7 +514,7 @@ function scanSecrets(options = {}) {
         path.join(home, 'projects'),
         path.join(home, 'Documents'),
         path.join(home, 'code'),
-    ].filter(root => fs.existsSync(root))));
+    ].filter(root => fs.existsSync(root) && !disabledRoots.has(path.resolve(root).toLowerCase()))));
     for (const envFile of collectEnvFiles(envRoots, maxDepth)) {
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/runtimeConfig.d.ts

@@ -26,6 +26,8 @@ export interface RuntimeBundle {
     suspended?: boolean;
     /** Admin-chosen extra posture scan folders for this machine (from the console). */
     extraScanRoots?: string[];
+    /** Default scan folders the admin explicitly removed from this machine's posture sweep. */
+    disabledScanRoots?: string[];
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;
@@ -58,8 +60,14 @@ export interface EffectiveBundle extends RuntimeBundle {
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
 /**
- * Admin-chosen extra posture scan folders from the most recent cached bundle
- * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
- * scans include console-selected folders without needing credentials plumbed in.
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
  */
+export declare function getCachedScanRootOverrides(): {
+    extraScanRoots: string[];
+    disabledScanRoots: string[];
+};
+/** @deprecated Use getCachedScanRootOverrides(). */
 export declare function getCachedExtraScanRoots(): string[];

package/dist/runtimeConfig.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -107,6 +108,9 @@ async function getRuntimeBundle(input) {
                     extraScanRoots: Array.isArray(body.data.extraScanRoots)
                         ? body.data.extraScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
                         : undefined,
+                    disabledScanRoots: Array.isArray(body.data.disabledScanRoots)
+                        ? body.data.disabledScanRoots.filter((root) => typeof root === 'string').slice(0, 20)
+                        : undefined,
                     machineAction: body.data.machineAction,
                     fetchedAt: Date.now(),
                 };
@@ -123,18 +127,28 @@ async function getRuntimeBundle(input) {
     return { mode: 'block', version: '', source: 'default' };
 }
 /**
- * Admin-chosen extra posture scan folders from the most recent cached bundle
- * (any shield). Read-only and offline — used by `discover` so scheduled/daemon
- * scans include console-selected folders without needing credentials plumbed in.
+ * Admin scan-folder choices from the most recent cached bundle (any shield):
+ * extra folders to add and default folders the admin removed. Read-only and
+ * offline — used by `discover` so scheduled/daemon scans honor the console
+ * selection without needing credentials plumbed in.
  */
-function getCachedExtraScanRoots() {
+function getCachedScanRootOverrides() {
     const cache = readCacheFile();
-    const roots = new Set();
+    const extra = new Set();
+    const disabled = new Set();
     for (const entry of Object.values(cache)) {
         for (const root of entry.extraScanRoots || []) {
             if (typeof root === 'string' && root.trim())
-                roots.add(root.trim());
+                extra.add(root.trim());
+        }
+        for (const root of entry.disabledScanRoots || []) {
+            if (typeof root === 'string' && root.trim())
+                disabled.add(root.trim());
         }
     }
-    return [...roots];
+    return { extraScanRoots: [...extra], disabledScanRoots: [...disabled] };
+}
+/** @deprecated Use getCachedScanRootOverrides(). */
+function getCachedExtraScanRoots() {
+    return getCachedScanRootOverrides().extraScanRoots;
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.15.9"
+  "version": "1.15.11"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.15.9",
+  "version": "1.15.11",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {