fullcourtdefense-cli 1.21.8 → 1.21.9

package/dist/commands/clipboardScan.js

@@ -22,18 +22,30 @@ const deterministicGuard_1 = require("./deterministicGuard");
  *    token.
  */
 const LONE_TOKEN = /^[A-Za-z0-9_\-+/=]{24,256}$/;
+function asClipboardFinding(finding) {
+    if (!finding)
+        return undefined;
+    // The underlying engine phrases reasons for tool responses ("Blocked tool
+    // response containing …"). Re-word for the clipboard/paste context without
+    // changing rule id, category, evidence, or toggles.
+    return {
+        ...finding,
+        ruleId: 'local-clipboard-secret',
+        reason: 'Secret detected on the clipboard — do not paste it into an unprotected AI chat.',
+    };
+}
 function scanDeterministicClipboard(text, options) {
     const trimmed = (text || '').trim();
     if (!trimmed)
         return undefined;
     const direct = (0, deterministicGuard_1.scanDeterministicTextResponse)(trimmed, options);
     if (direct)
-        return direct;
+        return asClipboardFinding(direct);
     if (LONE_TOKEN.test(trimmed)) {
         // Inject a canonical keyword so the contextual detector's proximity check
         // passes; its high-entropy gate still does the real work. The synthetic
         // prefix is never surfaced — the finding's evidence comes from the token.
-        return (0, deterministicGuard_1.scanDeterministicTextResponse)(`api key ${trimmed}`, options);
+        return asClipboardFinding((0, deterministicGuard_1.scanDeterministicTextResponse)(`api key ${trimmed}`, options));
     }
     return undefined;
 }

package/dist/notify.js

@@ -7,7 +7,13 @@ const child_process_1 = require("child_process");
 function spawnDetached(command, args, opts) {
     try {
         const child = (0, child_process_1.spawn)(command, args, {
-            detached: true,
+            // detached:true is BROKEN for PowerShell on the bundled Node/Windows
+            // runtime — the child gets a PID but never executes a single line, so
+            // every toast/alert was silently lost. Our callers (the long-lived
+            // daemon guard, and hooks running in wait/fail-closed mode) outlive the
+            // notification anyway, so a non-detached child renders and completes.
+            // Keep detached on POSIX where it works and short-lived CLIs benefit.
+            detached: process.platform !== 'win32',
             stdio: 'ignore',
             // windowsHide sets the process show-state to SW_HIDE, which a GUI child's
             // FIRST top-level window inherits — that silently hid the alert form.

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.8"
+  "version": "1.21.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.8",
+  "version": "1.21.9",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {