fullcourtdefense-cli 1.21.23 → 1.21.24

package/dist/commands/onboard.js

@@ -180,8 +180,13 @@ function checkMcpGateways() {
 function checkTerminalGuards() {
     const checks = [];
     if (process.platform === 'win32') {
-        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
-        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
+        // Warnings, not failures: managed/bank machines commonly block PowerShell
+        // profile and AutoRun registry writes (EDR persistence rules, redirected
+        // Documents folders). Hooks + MCP gateways + daemon still protect the
+        // machine; failing onboarding here makes the MSI roll back a protected
+        // install (seen on the first customer deployment).
+        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), optional: true, detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
+        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), optional: true, detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
         const audit = (0, windowsAudit_1.getWindowsAuditStatus)();
         const auditOk = audit.scriptBlockLogging && audit.transcription;
         checks.push({
@@ -415,8 +420,16 @@ async function onboardCommand(args, config) {
         checkMcpGateways(),
         ...checkTerminalGuards(),
         {
+            // Warning, not a failure: on hardened/managed machines (bank laptops,
+            // EDR blocking HKCU Run-key writes, standard users denied schtasks)
+            // autostart registration can be denied even though hooks, enrollment,
+            // and the in-session daemon are all healthy. Failing onboarding here
+            // makes the MSI roll back a genuinely protected install — instead we
+            // finish, and the fleet console nudges "run daemon --install" until
+            // the daemon reports (real gap seen on the first customer install).
             label: 'Resident daemon autostart',
             ok: (0, daemon_1.isDaemonAutostartInstalled)(),
+            optional: true,
             detail: (0, daemon_1.isDaemonAutostartInstalled)() ? undefined : 'run fullcourtdefense daemon --install true from an elevated terminal',
         },
         {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.23"
+  "version": "1.21.24"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.23",
+  "version": "1.21.24",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {