fullcourtdefense-cli 1.21.35 → 1.21.36

package/dist/commands/cmdGuard.d.ts

@@ -19,11 +19,17 @@ export declare function uninstallCmdGuardCommand(): Promise<void>;
 /** Refresh shared rules JSON when cmd guard is installed. */
 export declare function refreshCmdGuardRules(): void;
 /**
- * Self-heal a stale cmd-guard AutoRun: if the registry still references our
- * autorun script but the file was deleted (manual cleanup, interrupted
- * uninstall), EVERY cmd.exe on the machine errors on startup and — worse —
- * poisons `cmd /c` exit codes to 1, making healthy installs/commands look
- * failed. Strips only OUR fragment; a customer's own AutoRun entries survive.
- * Returns true when a repair was applied.
+ * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
+ *
+ *  1. Registry references our autorun bat but the FILE was deleted (manual
+ *     cleanup, interrupted uninstall) — every cmd.exe errors on startup and
+ *     poisons `cmd /c` exit codes to 1.
+ *  2. The bat EXISTS but its doskey macros point at a node.exe or checker
+ *     script that no longer exists (uninstall/upgrade removed the install
+ *     root but left the per-user bat) — every wrapped command (docker, git,
+ *     kubectl, …) fails with "cannot find the path specified".
+ *
+ * In both cases: strip OUR fragment from AutoRun (a customer's own entries
+ * survive) and delete our orphaned guard files. Returns true when repaired.
  */
 export declare function repairStaleCmdAutorun(): boolean;

package/dist/commands/cmdGuard.js

@@ -142,6 +142,11 @@ function buildAutorunBat(nodePath) {
         'REM Remove permanently: fullcourtdefense uninstall-cmd-guard',
         'if defined FCD_CMD_AUTORUN_DONE goto :eof',
         'set FCD_CMD_AUTORUN_DONE=1',
+        // FAIL OPEN: if the runtime or checker is gone (uninstall/upgrade left this
+        // bat behind), register NO macros — wrapped commands (docker, git, kubectl…)
+        // must keep working natively. Never break the customer's tools.
+        `if not exist ${node} goto :eof`,
+        `if not exist ${guardJs} goto :eof`,
         ...doskeyLines,
         '',
     ].join('\r\n');
@@ -266,12 +271,26 @@ function refreshCmdGuardRules() {
     catch { /* best-effort */ }
 }
 /**
- * Self-heal a stale cmd-guard AutoRun: if the registry still references our
- * autorun script but the file was deleted (manual cleanup, interrupted
- * uninstall), EVERY cmd.exe on the machine errors on startup and — worse —
- * poisons `cmd /c` exit codes to 1, making healthy installs/commands look
- * failed. Strips only OUR fragment; a customer's own AutoRun entries survive.
- * Returns true when a repair was applied.
+ * The node.exe path baked into an installed autorun bat's doskey macros.
+ * Format written by buildAutorunBat: `doskey <cmd>="<node>" "<guardJs>" <cmd> $*`.
+ */
+function autorunBatNodePath(batContent) {
+    const match = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
+    return match ? match[1] : undefined;
+}
+/**
+ * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
+ *
+ *  1. Registry references our autorun bat but the FILE was deleted (manual
+ *     cleanup, interrupted uninstall) — every cmd.exe errors on startup and
+ *     poisons `cmd /c` exit codes to 1.
+ *  2. The bat EXISTS but its doskey macros point at a node.exe or checker
+ *     script that no longer exists (uninstall/upgrade removed the install
+ *     root but left the per-user bat) — every wrapped command (docker, git,
+ *     kubectl, …) fails with "cannot find the path specified".
+ *
+ * In both cases: strip OUR fragment from AutoRun (a customer's own entries
+ * survive) and delete our orphaned guard files. Returns true when repaired.
  */
 function repairStaleCmdAutorun() {
     try {
@@ -280,8 +299,20 @@ function repairStaleCmdAutorun() {
         const current = readCurrentAutorun();
         if (!current.includes(AUTORUN_MARKER))
             return false;
-        if (fs.existsSync(AUTORUN_BAT_PATH))
-            return false;
+        if (fs.existsSync(AUTORUN_BAT_PATH)) {
+            // Bat present — only stale when its macro targets are gone.
+            let bat = '';
+            try {
+                bat = fs.readFileSync(AUTORUN_BAT_PATH, 'utf8');
+            }
+            catch {
+                return false;
+            }
+            const nodePath = autorunBatNodePath(bat);
+            const runtimeAlive = (!nodePath || fs.existsSync(nodePath)) && fs.existsSync(GUARD_JS_PATH);
+            if (runtimeAlive)
+                return false;
+        }
         const next = stripAutorunValue(current);
         if (next) {
             setRegString(CMD_AUTORUN_KEY, AUTORUN_VALUE, next);
@@ -291,6 +322,14 @@ function repairStaleCmdAutorun() {
                 windowsHide: true, timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
             });
         }
+        try {
+            fs.unlinkSync(AUTORUN_BAT_PATH);
+        }
+        catch { /* already gone */ }
+        try {
+            fs.unlinkSync(GUARD_JS_PATH);
+        }
+        catch { /* already gone */ }
         return true;
     }
     catch {

package/dist/commands/daemon.js

@@ -63,6 +63,7 @@ const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
+const cmdGuard_1 = require("./cmdGuard");
 const machineActionVerify_1 = require("../machineActionVerify");
 const desktopChatGuard_1 = require("./desktopChatGuard");
 const honeypot_1 = require("../honeypot");
@@ -1032,6 +1033,11 @@ async function runDaemon(args, config) {
     // Converge pre-Node-updater machines onto the PowerShell-free updater task
     // (best-effort; needs an elevated daemon to rewrite a SYSTEM task).
     (0, selfUpdate_1.modernizeUpdaterTask)(log);
+    // Heal a stale/broken cmd-guard AutoRun (bat deleted, or macros pointing at
+    // a dead node.exe) so wrapped commands (docker, git, …) never stay broken.
+    if ((0, cmdGuard_1.repairStaleCmdAutorun)()) {
+        log('Repaired a stale cmd.exe AutoRun / doskey guard left by an earlier install.');
+    }
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
     // First: if this boot IS the post-upgrade relaunch, confirm the pending

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.35"
+  "version": "1.21.36"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.35",
+  "version": "1.21.36",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {