fullcourtdefense-cli 1.18.0 → 1.18.2

package/dist/commands/daemon.js

@@ -76,6 +76,10 @@ const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
 const BUNDLE_POLL_MS = envMs('FCD_DAEMON_BUNDLE_POLL_MS', 60_000);
 /** Delay before the one-time initial discovery sweep on a fresh machine. */
 const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60_000);
+/** A discovery upload older than this is stale — the daemon catches up itself. */
+const DISCOVER_STALE_MS = envMs('FCD_DAEMON_DISCOVER_STALE_MS', 20 * 60 * 60_000);
+/** How often the daemon re-checks discovery freshness. */
+const DISCOVER_CHECK_INTERVAL_MS = envMs('FCD_DAEMON_DISCOVER_CHECK_MS', 60 * 60_000);
 /** Rotate the daemon log when it grows past this size. */
 const LOG_MAX_BYTES = 1_000_000;
 function daemonDir() {
@@ -535,9 +539,12 @@ async function runDaemon(args, config) {
                 if (!target)
                     throw new Error('No target version available — the control plane could not resolve the latest release.');
                 log(`Upgrade CLI: admin requested an upgrade to ${target}.`);
-                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, log });
+                // force: bypass the auto-update retry cooldown — an explicit admin
+                // action must actually attempt and report the real outcome, not
+                // "in progress" while a broken path silently retries hourly.
+                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, force: true, log });
                 if (!outcome) {
-                    resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target} (or an upgrade is in progress).`;
+                    resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target}.`;
                 }
                 else if (outcome.started) {
                     resultSummary = outcome.detail;
@@ -693,6 +700,45 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }, INITIAL_DISCOVER_DELAY_MS);
     }
+    // Staleness catch-up: the daily scheduled job fires at a FIXED hour, so a
+    // laptop that was asleep/powered off at that hour misses the whole day —
+    // admins then see day-old discovery/posture data even though the machine is
+    // online. The daemon closes that gap: whenever the last successful upload is
+    // older than ~20h, run a full sweep now. Checked shortly after boot (wake-up
+    // catch-up) and hourly thereafter; the marker written by `discover` keeps
+    // this idempotent alongside the scheduled task.
+    let discoverCatchUpRunning = false;
+    const maybeCatchUpDiscovery = async (reason) => {
+        if (stopped || discoverCatchUpRunning || !creds.shieldId)
+            return;
+        if (!(0, discoveryMarker_1.hasDiscoveryUploadMarker)())
+            return; // fresh machine — initial sweep owns it
+        const last = (0, discoveryMarker_1.lastDiscoveryUploadAt)();
+        if (last && Date.now() - last.getTime() < DISCOVER_STALE_MS)
+            return;
+        discoverCatchUpRunning = true;
+        log(`Discovery catch-up (${reason}): last upload ${last ? Math.round((Date.now() - last.getTime()) / 3_600_000) + 'h ago' : 'unknown'} — starting full sweep (MCP + secrets + agent files + posture)…`);
+        await uploadLogTail();
+        const logPump = setInterval(() => { void uploadLogTail(); }, 15_000);
+        try {
+            const exitCode = await runDiscoverSweep();
+            if (exitCode !== 0)
+                throw new Error(`discover exited with code ${exitCode}`);
+            log('Discovery catch-up: upload complete — dashboard discovery + posture timestamps are now fresh.');
+        }
+        catch (error) {
+            log(`Discovery catch-up failed (retried hourly): ${error.message}`);
+        }
+        finally {
+            clearInterval(logPump);
+            discoverCatchUpRunning = false;
+            await uploadLogTail();
+        }
+    };
+    // Give the machine a couple of minutes to settle after boot/wake before the
+    // first check — same grace as the initial sweep.
+    const discoverCatchUpBootTimer = setTimeout(() => { void maybeCatchUpDiscovery('after start'); }, INITIAL_DISCOVER_DELAY_MS);
+    const discoverCatchUpTimer = setInterval(() => { void maybeCatchUpDiscovery('hourly check'); }, DISCOVER_CHECK_INTERVAL_MS);
     const rescanTimer = setInterval(() => {
         const count = refreshWatchTargets();
         log(`Rescan: watching ${count} config file(s).`);
@@ -707,6 +753,8 @@ async function runDaemon(args, config) {
         clearInterval(rescanTimer);
         clearInterval(bundleTimer);
         clearInterval(heartbeatTimer);
+        clearTimeout(discoverCatchUpBootTimer);
+        clearInterval(discoverCatchUpTimer);
         if (initialDiscoverTimer)
             clearTimeout(initialDiscoverTimer);
         if (debounceTimer)

package/dist/discoveryMarker.d.ts

@@ -1,2 +1,9 @@
 export declare function hasDiscoveryUploadMarker(): boolean;
+/**
+ * When the last successful full discovery upload completed, or undefined if
+ * this machine never uploaded one. Drives the daemon's staleness catch-up:
+ * laptops that were powered off at the daily task's fixed hour still get a
+ * fresh scan shortly after they wake up.
+ */
+export declare function lastDiscoveryUploadAt(): Date | undefined;
 export declare function writeDiscoveryUploadMarker(trigger: string): void;

package/dist/discoveryMarker.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasDiscoveryUploadMarker = hasDiscoveryUploadMarker;
+exports.lastDiscoveryUploadAt = lastDiscoveryUploadAt;
 exports.writeDiscoveryUploadMarker = writeDiscoveryUploadMarker;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -55,6 +56,22 @@ function hasDiscoveryUploadMarker() {
         return false;
     }
 }
+/**
+ * When the last successful full discovery upload completed, or undefined if
+ * this machine never uploaded one. Drives the daemon's staleness catch-up:
+ * laptops that were powered off at the daily task's fixed hour still get a
+ * fresh scan shortly after they wake up.
+ */
+function lastDiscoveryUploadAt() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(markerFile(), 'utf8'));
+        const date = raw.completedAt ? new Date(raw.completedAt) : undefined;
+        return date && !Number.isNaN(date.getTime()) ? date : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function writeDiscoveryUploadMarker(trigger) {
     try {
         fs.mkdirSync(path.dirname(markerFile()), { recursive: true });

package/dist/selfUpdate.d.ts

@@ -36,6 +36,9 @@ export declare function maybeSelfUpdate(input: {
     log?: (message: string) => void;
     /** Skip while a remote machine action is executing (never upgrade mid-action). */
     busy?: boolean;
+    /** Bypass the retry cooldown — used by explicit admin upgrade_cli actions so
+     *  they always attempt and report the REAL outcome instead of "in progress". */
+    force?: boolean;
 }): SelfUpdateResult | undefined;
 /** Version the MSI updater script reads from the installed package.json. */
 export declare function installedMsiVersion(installFolder: string): string | undefined;

package/dist/selfUpdate.js

@@ -116,14 +116,45 @@ function startNpmSelfUpdate(targetVersion, log) {
  * but group policy can deny it — in that case the daily trigger remains the
  * backstop and we report that honestly.
  */
+/** Install folder of an MSI deployment (…\FullCourtDefense), from the running entry. */
+function msiInstallRoot() {
+    const entry = path.resolve(process.argv[1] || '');
+    // dist\index.js → install root is the parent of dist.
+    const dist = path.dirname(entry);
+    const root = path.dirname(dist);
+    return fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1')) ? root : undefined;
+}
+/**
+ * Self-heal a missing updater task. Machines installed from an older MSI (or
+ * where task creation was denied at install time) ship the updater SCRIPT but
+ * not the scheduled task — without this, every self-update tick dead-ends with
+ * "reinstall the MSI". Registration needs an elevated token, so this succeeds
+ * on elevated daemons and stays a silent no-op otherwise.
+ */
+function tryRegisterMsiUpdaterTask(log) {
+    const root = msiInstallRoot();
+    if (!root)
+        return false;
+    const script = path.join(root, 'Update-FullCourtDefense.ps1');
+    const taskCommand = `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${script}\\"`;
+    const create = (0, child_process_1.spawnSync)('schtasks', [
+        '/Create', '/TN', exports.MSI_UPDATER_TASK_NAME, '/TR', taskCommand,
+        '/SC', 'DAILY', '/ST', '03:07', '/RU', 'SYSTEM', '/RL', 'HIGHEST', '/F',
+    ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+    if (create.status === 0) {
+        log('Self-update: registered the missing MSI updater task (self-heal).');
+        return true;
+    }
+    return false;
+}
 function startMsiSelfUpdate(targetVersion, log) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
-    if (query.status !== 0) {
+    if (query.status !== 0 && !tryRegisterMsiUpdaterTask(log)) {
         log('Self-update: MSI updater task is not registered on this machine — reinstall the MSI to enable silent updates.');
         return {
             started: false,
             kind: 'msi',
-            detail: `The "${exports.MSI_UPDATER_TASK_NAME}" scheduled task is missing. Reinstall the latest MSI (or redeploy via MDM) to restore silent updates.`,
+            detail: `The "${exports.MSI_UPDATER_TASK_NAME}" scheduled task is missing and could not be self-registered (needs an elevated daemon). Reinstall the latest MSI once (or redeploy via MDM) to restore silent updates.`,
         };
     }
     const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
@@ -153,7 +184,7 @@ function maybeSelfUpdate(input) {
         return undefined;
     if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0)
         return undefined;
-    if (Date.now() - updateInFlightSince < UPDATE_RETRY_COOLDOWN_MS)
+    if (!input.force && Date.now() - updateInFlightSince < UPDATE_RETRY_COOLDOWN_MS)
         return undefined;
     updateInFlightSince = Date.now();
     log(`Self-update: CLI ${input.currentVersion || 'unknown'} -> ${input.targetVersion} (org auto-update).`);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.0"
+  "version": "1.18.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.0",
+  "version": "1.18.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {