fullcourtdefense-cli 1.21.23 → 1.21.25

package/dist/commands/discoverAgentFiles.js

@@ -253,11 +253,21 @@ function scanProjectRootAgentFiles(root, clientLabel, out, seen, excludedRoots =
                 sizeBytes: parsed.sizeBytes,
                 lineCount: parsed.lineCount,
                 content: parsed.content,
-                riskTags: parsed.content.includes('fullcourtdefense') ? [] : ['no_runtime_hook'],
+                riskTags: hasFcdRuntimeHook(parsed.content) ? [] : ['no_runtime_hook'],
             });
         }
     }
 }
+/**
+ * Whether a hooks config already routes through the FCD runtime hook.
+ * MUST be case-insensitive: MSI installs write CamelCase paths
+ * ("C:\Program Files (x86)\FullCourtDefense\…") while npm installs are
+ * lowercase — a case-sensitive check flagged every MSI machine as unhooked
+ * (first seen on the first customer install). Mirrors onboard's checkCursorHooks.
+ */
+function hasFcdRuntimeHook(content) {
+    return /fullcourtdefense|fcd-managed|botguard/i.test(content);
+}
 function scanAgentFilesWithMetadata(options = {}) {
     const home = os.homedir();
     const cwd = options.cwd || process.cwd();
@@ -303,7 +313,7 @@ function scanAgentFilesWithMetadata(options = {}) {
                 sizeBytes: parsed.sizeBytes,
                 lineCount: parsed.lineCount,
                 content: parsed.content,
-                riskTags: parsed.content.includes('fullcourtdefense') ? [] : ['no_runtime_hook'],
+                riskTags: hasFcdRuntimeHook(parsed.content) ? [] : ['no_runtime_hook'],
             });
         }
     }

package/dist/commands/onboard.js

@@ -180,8 +180,13 @@ function checkMcpGateways() {
 function checkTerminalGuards() {
     const checks = [];
     if (process.platform === 'win32') {
-        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
-        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
+        // Warnings, not failures: managed/bank machines commonly block PowerShell
+        // profile and AutoRun registry writes (EDR persistence rules, redirected
+        // Documents folders). Hooks + MCP gateways + daemon still protect the
+        // machine; failing onboarding here makes the MSI roll back a protected
+        // install (seen on the first customer deployment).
+        checks.push({ label: 'PowerShell shell guard', ok: (0, shellGuard_1.isShellGuardInstalled)(), optional: true, detail: (0, shellGuard_1.isShellGuardInstalled)() ? undefined : 'run install-shell-guard' });
+        checks.push({ label: 'cmd.exe shell guard', ok: (0, cmdGuard_1.isCmdGuardInstalled)(), optional: true, detail: (0, cmdGuard_1.isCmdGuardInstalled)() ? undefined : 'run install-cmd-guard' });
         const audit = (0, windowsAudit_1.getWindowsAuditStatus)();
         const auditOk = audit.scriptBlockLogging && audit.transcription;
         checks.push({
@@ -415,8 +420,16 @@ async function onboardCommand(args, config) {
         checkMcpGateways(),
         ...checkTerminalGuards(),
         {
+            // Warning, not a failure: on hardened/managed machines (bank laptops,
+            // EDR blocking HKCU Run-key writes, standard users denied schtasks)
+            // autostart registration can be denied even though hooks, enrollment,
+            // and the in-session daemon are all healthy. Failing onboarding here
+            // makes the MSI roll back a genuinely protected install — instead we
+            // finish, and the fleet console nudges "run daemon --install" until
+            // the daemon reports (real gap seen on the first customer install).
             label: 'Resident daemon autostart',
             ok: (0, daemon_1.isDaemonAutostartInstalled)(),
+            optional: true,
             detail: (0, daemon_1.isDaemonAutostartInstalled)() ? undefined : 'run fullcourtdefense daemon --install true from an elevated terminal',
         },
         {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.23"
+  "version": "1.21.25"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.23",
+  "version": "1.21.25",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {