fullcourtdefense-cli 1.17.1 → 1.18.1

package/dist/commands/daemon.js

@@ -76,6 +76,10 @@ const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
 const BUNDLE_POLL_MS = envMs('FCD_DAEMON_BUNDLE_POLL_MS', 60_000);
 /** Delay before the one-time initial discovery sweep on a fresh machine. */
 const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60_000);
+/** A discovery upload older than this is stale — the daemon catches up itself. */
+const DISCOVER_STALE_MS = envMs('FCD_DAEMON_DISCOVER_STALE_MS', 20 * 60 * 60_000);
+/** How often the daemon re-checks discovery freshness. */
+const DISCOVER_CHECK_INTERVAL_MS = envMs('FCD_DAEMON_DISCOVER_CHECK_MS', 60 * 60_000);
 /** Rotate the daemon log when it grows past this size. */
 const LOG_MAX_BYTES = 1_000_000;
 function daemonDir() {
@@ -535,9 +539,12 @@ async function runDaemon(args, config) {
                 if (!target)
                     throw new Error('No target version available — the control plane could not resolve the latest release.');
                 log(`Upgrade CLI: admin requested an upgrade to ${target}.`);
-                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, log });
+                // force: bypass the auto-update retry cooldown — an explicit admin
+                // action must actually attempt and report the real outcome, not
+                // "in progress" while a broken path silently retries hourly.
+                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, force: true, log });
                 if (!outcome) {
-                    resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target} (or an upgrade is in progress).`;
+                    resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target}.`;
                 }
                 else if (outcome.started) {
                     resultSummary = outcome.detail;
@@ -693,6 +700,45 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }, INITIAL_DISCOVER_DELAY_MS);
     }
+    // Staleness catch-up: the daily scheduled job fires at a FIXED hour, so a
+    // laptop that was asleep/powered off at that hour misses the whole day —
+    // admins then see day-old discovery/posture data even though the machine is
+    // online. The daemon closes that gap: whenever the last successful upload is
+    // older than ~20h, run a full sweep now. Checked shortly after boot (wake-up
+    // catch-up) and hourly thereafter; the marker written by `discover` keeps
+    // this idempotent alongside the scheduled task.
+    let discoverCatchUpRunning = false;
+    const maybeCatchUpDiscovery = async (reason) => {
+        if (stopped || discoverCatchUpRunning || !creds.shieldId)
+            return;
+        if (!(0, discoveryMarker_1.hasDiscoveryUploadMarker)())
+            return; // fresh machine — initial sweep owns it
+        const last = (0, discoveryMarker_1.lastDiscoveryUploadAt)();
+        if (last && Date.now() - last.getTime() < DISCOVER_STALE_MS)
+            return;
+        discoverCatchUpRunning = true;
+        log(`Discovery catch-up (${reason}): last upload ${last ? Math.round((Date.now() - last.getTime()) / 3_600_000) + 'h ago' : 'unknown'} — starting full sweep (MCP + secrets + agent files + posture)…`);
+        await uploadLogTail();
+        const logPump = setInterval(() => { void uploadLogTail(); }, 15_000);
+        try {
+            const exitCode = await runDiscoverSweep();
+            if (exitCode !== 0)
+                throw new Error(`discover exited with code ${exitCode}`);
+            log('Discovery catch-up: upload complete — dashboard discovery + posture timestamps are now fresh.');
+        }
+        catch (error) {
+            log(`Discovery catch-up failed (retried hourly): ${error.message}`);
+        }
+        finally {
+            clearInterval(logPump);
+            discoverCatchUpRunning = false;
+            await uploadLogTail();
+        }
+    };
+    // Give the machine a couple of minutes to settle after boot/wake before the
+    // first check — same grace as the initial sweep.
+    const discoverCatchUpBootTimer = setTimeout(() => { void maybeCatchUpDiscovery('after start'); }, INITIAL_DISCOVER_DELAY_MS);
+    const discoverCatchUpTimer = setInterval(() => { void maybeCatchUpDiscovery('hourly check'); }, DISCOVER_CHECK_INTERVAL_MS);
     const rescanTimer = setInterval(() => {
         const count = refreshWatchTargets();
         log(`Rescan: watching ${count} config file(s).`);
@@ -707,6 +753,8 @@ async function runDaemon(args, config) {
         clearInterval(rescanTimer);
         clearInterval(bundleTimer);
         clearInterval(heartbeatTimer);
+        clearTimeout(discoverCatchUpBootTimer);
+        clearInterval(discoverCatchUpTimer);
         if (initialDiscoverTimer)
             clearTimeout(initialDiscoverTimer);
         if (debounceTimer)

package/dist/commands/discover.js

@@ -35,7 +35,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverCommand = discoverCommand;
 exports.runDiscoverUpload = runDiscoverUpload;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -52,6 +51,7 @@ const discoverBlastRadius_1 = require("./discoverBlastRadius");
 const discoverSecrets_1 = require("./discoverSecrets");
 const windowsAudit_1 = require("./windowsAudit");
 const discoveryMarker_1 = require("../discoveryMarker");
+const machineIdentity_1 = require("../machineIdentity");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function parseSurfaces(args) {
     const raw = (args.surface || args.type || 'mcp').toLowerCase().trim();
@@ -93,9 +93,17 @@ function redactCommandArgs(args) {
     }
     return out;
 }
+/**
+ * The SAME stable hardware id used at enrollment (MachineGuid / IOPlatformUUID
+ * / machine-id, sha256 → 32 hex chars). Discovery uploads MUST carry this id:
+ * the fleet console attaches scan evidence to the enrolled machine strictly by
+ * machineId, so a divergent id here makes the machine page show "Never
+ * scanned" while the data sits under a ghost host record. (Pre-1.18 releases
+ * hashed hostname+username into a 16-char fingerprint — the backend still
+ * recognizes those as legacy and matches them by hostname.)
+ */
 function machineFingerprint() {
-    const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
-    return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
+    return (0, machineIdentity_1.getMachineIdentity)().machineId;
 }
 /** Detect ephemeral CI runners so they are never listed as user machines in the fleet. */
 function isCiEnvironment() {
@@ -613,6 +621,8 @@ function proxyStatusLabel(status) {
         return 'Proxied';
     if (status === 'direct')
         return 'Direct — needs gateway';
+    if (status === 'reference')
+        return 'Reference config — not loaded by any AI client';
     return 'Unknown';
 }
 function sanitizeSecretForUpload(finding) {
@@ -1036,7 +1046,9 @@ async function discoverCommand(args, config) {
             console.log('');
             if (clientCoverage.length > 0) {
                 for (const row of clientCoverage) {
-                    const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
+                    const gateway = (0, discoverProxy_1.isReferenceConfigSource)(row.client)
+                        ? `${COLOR.gray}reference only — not loaded by any AI client${COLOR.reset}`
+                        : row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
                     console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}`);
                 }
                 console.log('');

package/dist/commands/discoverProxy.d.ts

@@ -1,4 +1,5 @@
-export type DesktopProxyStatus = 'fcd_gateway' | 'proxied' | 'direct' | 'unknown';
+export type DesktopProxyStatus = 'fcd_gateway' | 'proxied' | 'direct' | 'reference' | 'unknown';
+export declare function isReferenceConfigSource(source: string): boolean;
 export declare const FCD_GATEWAY_SERVER_NAMES: Set<string>;
 export declare const FCD_HOOK_MARKER = "--fcd-managed true";
 export declare const FCD_HOOK_TAG = "fullcourtdefense";

package/dist/commands/discoverProxy.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FCD_HOOK_TAG = exports.FCD_HOOK_MARKER = exports.FCD_GATEWAY_SERVER_NAMES = void 0;
+exports.isReferenceConfigSource = isReferenceConfigSource;
 exports.isFcdGatewayServer = isFcdGatewayServer;
 exports.extractGatewayDownstream = extractGatewayDownstream;
 exports.buildGatewayWrapIndex = buildGatewayWrapIndex;
@@ -44,6 +45,18 @@ exports.buildClientCoverage = buildClientCoverage;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+/**
+ * Config sources that no AI client actually loads. A plain `mcp.json` at a
+ * repo root is documentation/sample material — Cursor, Claude Code, VS Code,
+ * Windsurf, etc. all read their own dot-folder configs, never this file.
+ * Servers found there are inventory-worthy (they show what a repo references)
+ * but are not live attack surface, so they classify as 'reference' instead of
+ * 'direct' and must never count toward the machine's exposed status.
+ */
+const REFERENCE_CONFIG_SOURCES = new Set(['Repo (mcp.json)']);
+function isReferenceConfigSource(source) {
+    return REFERENCE_CONFIG_SOURCES.has(source);
+}
 exports.FCD_GATEWAY_SERVER_NAMES = new Set([
     'agentguard-gateway',
     'fullcourtdefense-gateway',
@@ -157,6 +170,8 @@ function buildGatewayWrapIndex(servers) {
     return wrapsByConfig;
 }
 function classifyProxyStatus(server, wrapsByConfig) {
+    if (isReferenceConfigSource(server.source))
+        return 'reference';
     if (isFcdGatewayServer(server))
         return 'fcd_gateway';
     const wrapped = wrapsByConfig.get(server.configPath.toLowerCase());

package/dist/discoveryMarker.d.ts

@@ -1,2 +1,9 @@
 export declare function hasDiscoveryUploadMarker(): boolean;
+/**
+ * When the last successful full discovery upload completed, or undefined if
+ * this machine never uploaded one. Drives the daemon's staleness catch-up:
+ * laptops that were powered off at the daily task's fixed hour still get a
+ * fresh scan shortly after they wake up.
+ */
+export declare function lastDiscoveryUploadAt(): Date | undefined;
 export declare function writeDiscoveryUploadMarker(trigger: string): void;

package/dist/discoveryMarker.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasDiscoveryUploadMarker = hasDiscoveryUploadMarker;
+exports.lastDiscoveryUploadAt = lastDiscoveryUploadAt;
 exports.writeDiscoveryUploadMarker = writeDiscoveryUploadMarker;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -55,6 +56,22 @@ function hasDiscoveryUploadMarker() {
         return false;
     }
 }
+/**
+ * When the last successful full discovery upload completed, or undefined if
+ * this machine never uploaded one. Drives the daemon's staleness catch-up:
+ * laptops that were powered off at the daily task's fixed hour still get a
+ * fresh scan shortly after they wake up.
+ */
+function lastDiscoveryUploadAt() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(markerFile(), 'utf8'));
+        const date = raw.completedAt ? new Date(raw.completedAt) : undefined;
+        return date && !Number.isNaN(date.getTime()) ? date : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function writeDiscoveryUploadMarker(trigger) {
     try {
         fs.mkdirSync(path.dirname(markerFile()), { recursive: true });

package/dist/selfUpdate.d.ts

@@ -36,6 +36,9 @@ export declare function maybeSelfUpdate(input: {
     log?: (message: string) => void;
     /** Skip while a remote machine action is executing (never upgrade mid-action). */
     busy?: boolean;
+    /** Bypass the retry cooldown — used by explicit admin upgrade_cli actions so
+     *  they always attempt and report the REAL outcome instead of "in progress". */
+    force?: boolean;
 }): SelfUpdateResult | undefined;
 /** Version the MSI updater script reads from the installed package.json. */
 export declare function installedMsiVersion(installFolder: string): string | undefined;

package/dist/selfUpdate.js

@@ -116,14 +116,45 @@ function startNpmSelfUpdate(targetVersion, log) {
  * but group policy can deny it — in that case the daily trigger remains the
  * backstop and we report that honestly.
  */
+/** Install folder of an MSI deployment (…\FullCourtDefense), from the running entry. */
+function msiInstallRoot() {
+    const entry = path.resolve(process.argv[1] || '');
+    // dist\index.js → install root is the parent of dist.
+    const dist = path.dirname(entry);
+    const root = path.dirname(dist);
+    return fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1')) ? root : undefined;
+}
+/**
+ * Self-heal a missing updater task. Machines installed from an older MSI (or
+ * where task creation was denied at install time) ship the updater SCRIPT but
+ * not the scheduled task — without this, every self-update tick dead-ends with
+ * "reinstall the MSI". Registration needs an elevated token, so this succeeds
+ * on elevated daemons and stays a silent no-op otherwise.
+ */
+function tryRegisterMsiUpdaterTask(log) {
+    const root = msiInstallRoot();
+    if (!root)
+        return false;
+    const script = path.join(root, 'Update-FullCourtDefense.ps1');
+    const taskCommand = `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${script}\\"`;
+    const create = (0, child_process_1.spawnSync)('schtasks', [
+        '/Create', '/TN', exports.MSI_UPDATER_TASK_NAME, '/TR', taskCommand,
+        '/SC', 'DAILY', '/ST', '03:07', '/RU', 'SYSTEM', '/RL', 'HIGHEST', '/F',
+    ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+    if (create.status === 0) {
+        log('Self-update: registered the missing MSI updater task (self-heal).');
+        return true;
+    }
+    return false;
+}
 function startMsiSelfUpdate(targetVersion, log) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
-    if (query.status !== 0) {
+    if (query.status !== 0 && !tryRegisterMsiUpdaterTask(log)) {
         log('Self-update: MSI updater task is not registered on this machine — reinstall the MSI to enable silent updates.');
         return {
             started: false,
             kind: 'msi',
-            detail: `The "${exports.MSI_UPDATER_TASK_NAME}" scheduled task is missing. Reinstall the latest MSI (or redeploy via MDM) to restore silent updates.`,
+            detail: `The "${exports.MSI_UPDATER_TASK_NAME}" scheduled task is missing and could not be self-registered (needs an elevated daemon). Reinstall the latest MSI once (or redeploy via MDM) to restore silent updates.`,
         };
     }
     const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
@@ -153,7 +184,7 @@ function maybeSelfUpdate(input) {
         return undefined;
     if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0)
         return undefined;
-    if (Date.now() - updateInFlightSince < UPDATE_RETRY_COOLDOWN_MS)
+    if (!input.force && Date.now() - updateInFlightSince < UPDATE_RETRY_COOLDOWN_MS)
         return undefined;
     updateInFlightSince = Date.now();
     log(`Self-update: CLI ${input.currentVersion || 'unknown'} -> ${input.targetVersion} (org auto-update).`);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.17.1"
+  "version": "1.18.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.17.1",
+  "version": "1.18.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {