fullcourtdefense-cli 1.21.18 → 1.21.19

package/dist/commands/discover.js

@@ -840,13 +840,13 @@ async function discoverCommand(args, config) {
     const { extraScanRoots: adminScanRoots, disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
     const normalizedDisabledRoots = (0, discoverPaths_1.uniqueNormalizedPaths)(disabledScanRoots);
     const isDisabledRoot = (root) => (0, discoverPaths_1.isExcludedPath)(root, normalizedDisabledRoots);
-    const scanRoots = (0, discoverPaths_1.uniqueNormalizedPaths)([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])
+    const scanRoots = (0, discoverPaths_1.compactScanRoots)([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])
         .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0
         ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots, { excludedRoots: normalizedDisabledRoots })
         : { candidates: [], scannedDirs: 0, excludedDirs: 0, truncated: false, maxDepth: 4, maxDirs: 25000 };
     // Admin roots are scanned for env/secrets even when no MCP config lives there.
-    const sweepProjectRoots = (0, discoverPaths_1.uniqueNormalizedPaths)([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])
+    const sweepProjectRoots = (0, discoverPaths_1.compactScanRoots)([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])
         .filter(root => !isDisabledRoot(root));
     const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath)
         .filter(candidate => !isDisabledRoot(candidate.path));
@@ -914,17 +914,19 @@ async function discoverCommand(args, config) {
     const home = os.homedir();
     // Effective roots the posture scan covered — proof of coverage for the console.
     // Admin-removed defaults are excluded here too, so the console mirrors reality.
-    const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
-        .map(root => path.resolve(root));
+    const defaultEnvRoots = (0, discoverPaths_1.compactScanRoots)([home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
+        .map(root => path.resolve(root)));
     const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
-    const scannedRoots = [
+    const scannedRootCandidates = [
         ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root) && !isDisabledRoot(root)).map(root => ({ path: root, source: 'default' })),
         ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
         ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
             .map(root => path.resolve(root))
             .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()) && !isDisabledRoot(root))
             .map(root => ({ path: root, source: 'default' })),
-    ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
+    ];
+    const compactedScannedPaths = (0, discoverPaths_1.compactScanRoots)(scannedRootCandidates.map(entry => entry.path));
+    const scannedRoots = compactedScannedPaths.map(root => scannedRootCandidates.find(entry => path.resolve(entry.path).toLowerCase() === path.resolve(root).toLowerCase()));
     // Shallow folder tree for the console folder picker (names only, no contents).
     const folderCatalog = surfaces.has('posture') || surfaces.has('secrets')
         ? (0, discoverPaths_1.buildFolderCatalog)({ extraRoots: adminScanRoots })

package/dist/commands/discoverPaths.d.ts

@@ -14,6 +14,11 @@ export declare function normalizedPath(value: string): string;
 export declare function pathIsWithin(candidate: string, root: string): boolean;
 export declare function isExcludedPath(candidate: string, excludedRoots?: string[]): boolean;
 export declare function uniqueNormalizedPaths(values: string[]): string[];
+/**
+ * Keep only the shallowest non-overlapping scan roots. If C:\dev is present,
+ * C:\dev\repo is redundant: the bounded parent walk already covers it.
+ */
+export declare function compactScanRoots(values: string[]): string[];
 export declare function claudeDesktopMsixCandidates(): ClaudeDesktopConfigCandidate[];
 export declare function claudeDesktopConfigCandidates(): ClaudeDesktopConfigCandidate[];
 export declare function claudeDesktopLikelyInstalled(): boolean;

package/dist/commands/discoverPaths.js

@@ -37,6 +37,7 @@ exports.normalizedPath = normalizedPath;
 exports.pathIsWithin = pathIsWithin;
 exports.isExcludedPath = isExcludedPath;
 exports.uniqueNormalizedPaths = uniqueNormalizedPaths;
+exports.compactScanRoots = compactScanRoots;
 exports.claudeDesktopMsixCandidates = claudeDesktopMsixCandidates;
 exports.claudeDesktopConfigCandidates = claudeDesktopConfigCandidates;
 exports.claudeDesktopLikelyInstalled = claudeDesktopLikelyInstalled;
@@ -75,6 +76,22 @@ function uniqueNormalizedPaths(values) {
     }
     return [...out.values()];
 }
+/**
+ * Keep only the shallowest non-overlapping scan roots. If C:\dev is present,
+ * C:\dev\repo is redundant: the bounded parent walk already covers it.
+ */
+function compactScanRoots(values) {
+    const roots = uniqueNormalizedPaths(values)
+        .sort((a, b) => normalizedPath(a).split(path.sep).length - normalizedPath(b).split(path.sep).length
+        || normalizedPath(a).length - normalizedPath(b).length);
+    const compacted = [];
+    for (const root of roots) {
+        if (compacted.some(parent => pathIsWithin(root, parent)))
+            continue;
+        compacted.push(root);
+    }
+    return compacted;
+}
 function claudeDesktopDocumentedPath() {
     const home = os.homedir();
     if (process.platform === 'win32') {
@@ -269,7 +286,7 @@ function scanRootsForProjectConfigs(roots, options = {}) {
     let excludedDirs = 0;
     let depthLimited = false;
     const queue = [];
-    for (const root of uniqueNormalizedPaths(roots)) {
+    for (const root of compactScanRoots(roots)) {
         try {
             const resolved = path.resolve(root);
             if (!isExcludedPath(resolved, options.excludedRoots) && fs.statSync(resolved).isDirectory())

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.18"
+  "version": "1.21.19"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.18",
+  "version": "1.21.19",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -35,6 +35,7 @@
     "test:machine-action-signing": "npm run build && node scripts/test-machine-action-signing.js",
     "test:integrity": "npm run build && node scripts/test-integrity.js",
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
+    "test:scan-root-compaction": "npm run build && node scripts/test-scan-root-compaction.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",