fullcourtdefense-cli 1.21.18 → 1.21.20

package/dist/commands/daemon.d.ts

@@ -7,6 +7,8 @@ export interface DaemonArgs extends ProtectAllArgs {
     /** Suppress OS toasts (still logs). */
     quiet?: string;
 }
+/** Arguments shared by first-boot, stale catch-up, and web-triggered scans. */
+export declare function daemonDiscoverSweepArgs(): string[];
 /** Whether the daemon has been registered to start automatically. */
 export declare function isDaemonAutostartInstalled(): boolean;
 export declare function daemonCommand(args: DaemonArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/daemon.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.isDaemonAutostartInstalled = isDaemonAutostartInstalled;
 exports.daemonCommand = daemonCommand;
 const fs = __importStar(require("fs"));
@@ -142,12 +143,19 @@ function stopPid(pid) {
 function logFile() {
     return path.join(daemonDir(), 'daemon.log');
 }
-/** Spawn `discover --upload --surface all --silent` and wait for it to finish. */
+/** Arguments shared by first-boot, stale catch-up, and web-triggered scans. */
+function daemonDiscoverSweepArgs() {
+    return ['discover', '--upload', '--surface', 'all', '--deep', 'true', '--silent', '--scan-root', 'auto'];
+}
+/** Spawn a full known-client discovery + posture sweep and wait for it to finish. */
 function runDiscoverSweep(timeoutMs = 300_000) {
     return new Promise((resolve, reject) => {
         // --scan-root auto sweeps the default dev roots; admin-selected folders from
         // the console are merged in by discover itself (cached runtime bundle).
-        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'discover', '--upload', '--surface', 'all', '--silent', '--scan-root', 'auto'], {
+        // --deep inventories tools from known configured clients (Claude Desktop,
+        // Cursor, etc.). We intentionally do NOT pass --deep-roots, so arbitrary
+        // stdio servers merely found in other project trees are never auto-spawned.
+        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), ...daemonDiscoverSweepArgs()], {
             windowsHide: true,
             stdio: 'ignore',
             // Daemon/scheduled-task cwd is C:\WINDOWS\system32 — scan from the user's

package/dist/commands/discover.js

@@ -840,13 +840,13 @@ async function discoverCommand(args, config) {
     const { extraScanRoots: adminScanRoots, disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
     const normalizedDisabledRoots = (0, discoverPaths_1.uniqueNormalizedPaths)(disabledScanRoots);
     const isDisabledRoot = (root) => (0, discoverPaths_1.isExcludedPath)(root, normalizedDisabledRoots);
-    const scanRoots = (0, discoverPaths_1.uniqueNormalizedPaths)([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])
+    const scanRoots = (0, discoverPaths_1.compactScanRoots)([...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot), ...adminScanRoots])
         .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0
         ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots, { excludedRoots: normalizedDisabledRoots })
         : { candidates: [], scannedDirs: 0, excludedDirs: 0, truncated: false, maxDepth: 4, maxDirs: 25000 };
     // Admin roots are scanned for env/secrets even when no MCP config lives there.
-    const sweepProjectRoots = (0, discoverPaths_1.uniqueNormalizedPaths)([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])
+    const sweepProjectRoots = (0, discoverPaths_1.compactScanRoots)([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])
         .filter(root => !isDisabledRoot(root));
     const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath)
         .filter(candidate => !isDisabledRoot(candidate.path));
@@ -914,17 +914,19 @@ async function discoverCommand(args, config) {
     const home = os.homedir();
     // Effective roots the posture scan covered — proof of coverage for the console.
     // Admin-removed defaults are excluded here too, so the console mirrors reality.
-    const defaultEnvRoots = [home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
-        .map(root => path.resolve(root));
+    const defaultEnvRoots = (0, discoverPaths_1.compactScanRoots)([home, cwd, path.join(home, 'dev'), path.join(home, 'repos'), path.join(home, 'projects'), path.join(home, 'Documents'), path.join(home, 'code')]
+        .map(root => path.resolve(root)));
     const adminRootSet = new Set(adminScanRoots.map(root => path.resolve(root).toLowerCase()));
-    const scannedRoots = [
+    const scannedRootCandidates = [
         ...[...new Set(defaultEnvRoots)].filter(root => fs.existsSync(root) && !isDisabledRoot(root)).map(root => ({ path: root, source: 'default' })),
         ...adminScanRoots.map(root => path.resolve(root)).filter(root => fs.existsSync(root)).map(root => ({ path: root, source: 'admin' })),
         ...(0, discoverPaths_1.resolveScanRoots)(args.scanRoot)
             .map(root => path.resolve(root))
             .filter(root => fs.existsSync(root) && !adminRootSet.has(root.toLowerCase()) && !isDisabledRoot(root))
             .map(root => ({ path: root, source: 'default' })),
-    ].filter((entry, index, list) => list.findIndex(other => other.path.toLowerCase() === entry.path.toLowerCase()) === index);
+    ];
+    const compactedScannedPaths = (0, discoverPaths_1.compactScanRoots)(scannedRootCandidates.map(entry => entry.path));
+    const scannedRoots = compactedScannedPaths.map(root => scannedRootCandidates.find(entry => path.resolve(entry.path).toLowerCase() === path.resolve(root).toLowerCase()));
     // Shallow folder tree for the console folder picker (names only, no contents).
     const folderCatalog = surfaces.has('posture') || surfaces.has('secrets')
         ? (0, discoverPaths_1.buildFolderCatalog)({ extraRoots: adminScanRoots })

package/dist/commands/discoverPaths.d.ts

@@ -14,6 +14,11 @@ export declare function normalizedPath(value: string): string;
 export declare function pathIsWithin(candidate: string, root: string): boolean;
 export declare function isExcludedPath(candidate: string, excludedRoots?: string[]): boolean;
 export declare function uniqueNormalizedPaths(values: string[]): string[];
+/**
+ * Keep only the shallowest non-overlapping scan roots. If C:\dev is present,
+ * C:\dev\repo is redundant: the bounded parent walk already covers it.
+ */
+export declare function compactScanRoots(values: string[]): string[];
 export declare function claudeDesktopMsixCandidates(): ClaudeDesktopConfigCandidate[];
 export declare function claudeDesktopConfigCandidates(): ClaudeDesktopConfigCandidate[];
 export declare function claudeDesktopLikelyInstalled(): boolean;

package/dist/commands/discoverPaths.js

@@ -37,6 +37,7 @@ exports.normalizedPath = normalizedPath;
 exports.pathIsWithin = pathIsWithin;
 exports.isExcludedPath = isExcludedPath;
 exports.uniqueNormalizedPaths = uniqueNormalizedPaths;
+exports.compactScanRoots = compactScanRoots;
 exports.claudeDesktopMsixCandidates = claudeDesktopMsixCandidates;
 exports.claudeDesktopConfigCandidates = claudeDesktopConfigCandidates;
 exports.claudeDesktopLikelyInstalled = claudeDesktopLikelyInstalled;
@@ -75,6 +76,22 @@ function uniqueNormalizedPaths(values) {
     }
     return [...out.values()];
 }
+/**
+ * Keep only the shallowest non-overlapping scan roots. If C:\dev is present,
+ * C:\dev\repo is redundant: the bounded parent walk already covers it.
+ */
+function compactScanRoots(values) {
+    const roots = uniqueNormalizedPaths(values)
+        .sort((a, b) => normalizedPath(a).split(path.sep).length - normalizedPath(b).split(path.sep).length
+        || normalizedPath(a).length - normalizedPath(b).length);
+    const compacted = [];
+    for (const root of roots) {
+        if (compacted.some(parent => pathIsWithin(root, parent)))
+            continue;
+        compacted.push(root);
+    }
+    return compacted;
+}
 function claudeDesktopDocumentedPath() {
     const home = os.homedir();
     if (process.platform === 'win32') {
@@ -269,7 +286,7 @@ function scanRootsForProjectConfigs(roots, options = {}) {
     let excludedDirs = 0;
     let depthLimited = false;
     const queue = [];
-    for (const root of uniqueNormalizedPaths(roots)) {
+    for (const root of compactScanRoots(roots)) {
         try {
             const resolved = path.resolve(root);
             if (!isExcludedPath(resolved, options.excludedRoots) && fs.statSync(resolved).isDirectory())

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.18"
+  "version": "1.21.20"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.18",
+  "version": "1.21.20",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -32,9 +32,11 @@
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "test:daemon-e2e": "npm run build && node scripts/test-daemon-e2e.js",
+    "test:daemon-discovery-args": "npm run build && node scripts/test-daemon-discovery-args.js",
     "test:machine-action-signing": "npm run build && node scripts/test-machine-action-signing.js",
     "test:integrity": "npm run build && node scripts/test-integrity.js",
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
+    "test:scan-root-compaction": "npm run build && node scripts/test-scan-root-compaction.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",