fullcourtdefense-cli 1.22.7 → 1.23.0

package/dist/backupManifest.d.ts

@@ -0,0 +1,7 @@
+export declare function backupManifestPath(): string;
+/** Every recorded backup path (absent/corrupt manifest = empty list). */
+export declare function readBackupManifest(): string[];
+/** Record one backup file path. Deduped, capped, never throws. */
+export declare function recordConfigBackup(backupPath: string): void;
+/** Drop entries whose backup file no longer exists (post-cleanup compaction). */
+export declare function pruneBackupManifest(): void;

package/dist/backupManifest.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.backupManifestPath = backupManifestPath;
+exports.readBackupManifest = readBackupManifest;
+exports.recordConfigBackup = recordConfigBackup;
+exports.pruneBackupManifest = pruneBackupManifest;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Ledger of every `*.fcd-backup-*` config safety copy the CLI creates.
+ *
+ * MCP-config edits back the original file up next to it — including
+ * PROJECT-LOCAL configs (a repo's .cursor/mcp.json), which live in places no
+ * directory scan can enumerate. Those backups can embed live credentials, so
+ * `uninstall` / `verify-removed` must be able to find every one of them: each
+ * backup path is recorded here at creation time and the manifest is the
+ * authoritative list at cleanup time (union-ed with the known-dir scan for
+ * backups created by older CLI versions).
+ *
+ * Best-effort by design: a manifest write failure must never break a protect
+ * operation, and cleanup falls back to the directory scan.
+ */
+const MANIFEST_NAME = 'backup-manifest.json';
+const MAX_ENTRIES = 2000;
+function backupManifestPath() {
+    return path.join(os.homedir(), '.fullcourtdefense', MANIFEST_NAME);
+}
+/** Every recorded backup path (absent/corrupt manifest = empty list). */
+function readBackupManifest() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(backupManifestPath(), 'utf8'));
+        const entries = Array.isArray(raw?.backups) ? raw.backups : [];
+        return entries.filter((entry) => typeof entry === 'string' && entry.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/** Record one backup file path. Deduped, capped, never throws. */
+function recordConfigBackup(backupPath) {
+    try {
+        const existing = readBackupManifest();
+        if (existing.includes(backupPath))
+            return;
+        const entries = [...existing, backupPath].slice(-MAX_ENTRIES);
+        const file = backupManifestPath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, `${JSON.stringify({ backups: entries }, null, 2)}\n`, 'utf8');
+    }
+    catch { /* best effort — cleanup still has the directory scan */ }
+}
+/** Drop entries whose backup file no longer exists (post-cleanup compaction). */
+function pruneBackupManifest() {
+    try {
+        const existing = readBackupManifest();
+        const remaining = existing.filter(entry => {
+            try {
+                return fs.existsSync(entry);
+            }
+            catch {
+                return true;
+            }
+        });
+        if (remaining.length === existing.length)
+            return;
+        const file = backupManifestPath();
+        if (remaining.length === 0) {
+            fs.rmSync(file, { force: true });
+            return;
+        }
+        fs.writeFileSync(file, `${JSON.stringify({ backups: remaining }, null, 2)}\n`, 'utf8');
+    }
+    catch { /* best effort */ }
+}

package/dist/commands/ciProtect.d.ts

@@ -0,0 +1,42 @@
+import { BotGuardConfig } from '../config';
+/**
+ * `fullcourtdefense ci-protect` — one-command runtime protection for CI jobs.
+ *
+ * A CI runner is born, runs one job with an AI agent inside, and dies — no
+ * human to click a consent dialog, no durable disk for a fleet token. So the
+ * flow differs from laptop onboarding in exactly two ways:
+ *
+ *   1. Auth is the org API key (FCD_API_KEY repo secret) — the admin who put
+ *      it there consented for the pipeline.
+ *   2. Fleet identity is the PIPELINE (provider/repo/workflow), not the
+ *      runner: the backend converges every run onto one machine record, and
+ *      we export FCD_MACHINE_ID so the hooks installed here attribute all
+ *      events to that pipeline record.
+ *
+ * Everything else is the exact laptop stack: same Claude-format hook, same
+ * MCP gateway, same vendored policy engine enforcing offline.
+ */
+export interface CiProtectArgs {
+    apiKey?: string;
+    apiUrl?: string;
+    provider?: string;
+    repo?: string;
+    workflow?: string;
+    runId?: string;
+    runUrl?: string;
+    /** 'false' => skip installing the Claude-format runtime hook. */
+    hooks?: string;
+    /** 'false' => skip wrapping MCP client configs with the gateway. */
+    gateway?: string;
+}
+interface CiContext {
+    provider: string;
+    repo?: string;
+    workflow?: string;
+    runId?: string;
+    runUrl?: string;
+}
+/** Detect the pipeline from standard CI env vars (GitHub Actions, GitLab CI). */
+export declare function detectCiContext(env?: NodeJS.ProcessEnv): CiContext | undefined;
+export declare function ciProtectCommand(args: CiProtectArgs, config: BotGuardConfig): Promise<void>;
+export {};

package/dist/commands/ciProtect.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectCiContext = detectCiContext;
+exports.ciProtectCommand = ciProtectCommand;
+const fs = __importStar(require("fs"));
+const config_1 = require("../config");
+const installClaudeHook_1 = require("./installClaudeHook");
+const mcpGateway_1 = require("./mcpGateway");
+/** Detect the pipeline from standard CI env vars (GitHub Actions, GitLab CI). */
+function detectCiContext(env = process.env) {
+    if (env.GITHUB_ACTIONS === 'true') {
+        const repo = env.GITHUB_REPOSITORY || undefined;
+        const runId = env.GITHUB_RUN_ID || undefined;
+        return {
+            provider: 'github-actions',
+            repo,
+            workflow: env.GITHUB_WORKFLOW || undefined,
+            runId,
+            runUrl: repo && runId ? `${env.GITHUB_SERVER_URL || 'https://github.com'}/${repo}/actions/runs/${runId}` : undefined,
+        };
+    }
+    if (env.GITLAB_CI === 'true') {
+        return {
+            provider: 'gitlab-ci',
+            repo: env.CI_PROJECT_PATH || undefined,
+            workflow: env.CI_JOB_NAME || env.CI_PIPELINE_NAME || undefined,
+            runId: env.CI_PIPELINE_ID || undefined,
+            runUrl: env.CI_PIPELINE_URL || undefined,
+        };
+    }
+    return undefined;
+}
+/**
+ * Best-effort log streaming to the dashboard's CI Pipelines page — the admin
+ * watches this job's protection steps live without opening GitHub. Never
+ * throws and never blocks the job for more than a few seconds.
+ */
+function ciLogSender(apiUrl, apiKey, ctx) {
+    return async (lines, status) => {
+        try {
+            await fetch(`${apiUrl}/api/cli/ci-log`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'X-API-Key': apiKey },
+                body: JSON.stringify({ ...ctx, lines, status }),
+                signal: AbortSignal.timeout(4000),
+            });
+        }
+        catch { /* log delivery is best-effort */ }
+    };
+}
+async function ciProtectCommand(args, config) {
+    const creds = (0, config_1.resolveCliCredentials)(config, { apiUrl: args.apiUrl });
+    const apiUrl = creds.apiUrl;
+    const apiKey = (args.apiKey || process.env.FCD_API_KEY || '').trim();
+    if (!apiKey) {
+        throw new Error('An organization API key is required. Add FCD_API_KEY to the repo/pipeline secrets '
+            + '(create one in the dashboard: Workspace → API keys) or pass --api-key.');
+    }
+    const detected = detectCiContext();
+    const provider = (args.provider || detected?.provider || 'generic-ci').trim();
+    const repo = (args.repo || detected?.repo || '').trim();
+    const workflow = (args.workflow || detected?.workflow || '').trim();
+    if (!repo || !workflow) {
+        throw new Error('Could not detect the pipeline identity. On GitHub Actions / GitLab CI it is auto-detected; '
+            + 'elsewhere pass --repo <org/repo> --workflow <name>.');
+    }
+    const runId = (args.runId || detected?.runId || '').trim() || undefined;
+    const runUrl = (args.runUrl || detected?.runUrl || '').trim() || undefined;
+    console.log('\x1b[1m\x1b[36mFullCourtDefense — CI runtime protection\x1b[0m');
+    console.log(`  Pipeline: ${provider}/${repo}/${workflow}`);
+    if (runId)
+        console.log(`  Run:      ${runId}`);
+    const sendLog = ciLogSender(apiUrl, apiKey, { provider, repo, workflow, runId, runUrl });
+    const resp = await fetch(`${apiUrl}/api/cli/enroll/ci`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'X-API-Key': apiKey },
+        body: JSON.stringify({
+            provider,
+            repo,
+            workflow,
+            runId,
+            runUrl,
+            cliVersion: process.env.npm_package_version,
+        }),
+    });
+    const data = (await resp.json().catch(() => ({})));
+    if (!resp.ok || data.success === false || !data.data) {
+        const reason = data.error || `CI enrollment failed (HTTP ${resp.status})`;
+        await sendLog([{ level: 'error', message: `Enrollment failed: ${reason}` }], 'failed');
+        throw new Error(reason);
+    }
+    const result = data.data;
+    const savedPath = (0, config_1.saveSetupConfig)({
+        organizationId: result.organizationId,
+        shieldId: result.shieldId,
+        shieldKey: result.shieldKey,
+        apiUrl,
+    });
+    // Attribute every subsequent hook/gateway event in this job to the PIPELINE
+    // machine record: current process + GITHUB_ENV for the steps that follow
+    // (where the AI agent actually runs).
+    const identityEnv = {
+        FCD_MACHINE_ID: result.machineId,
+        FCD_DEVELOPER_NAME: `ci@${repo.toLowerCase()}`,
+        FCD_MACHINE_HOSTNAME: result.pipeline.key,
+    };
+    for (const [key, value] of Object.entries(identityEnv))
+        process.env[key] = value;
+    if (process.env.GITHUB_ENV) {
+        try {
+            fs.appendFileSync(process.env.GITHUB_ENV, Object.entries(identityEnv).map(([k, v]) => `${k}=${v}\n`).join(''));
+        }
+        catch { /* non-GitHub runner with a stray env var — identity still set for this process */ }
+    }
+    console.log(`\x1b[32m✓ ${result.reused ? 'Pipeline re-enrolled' : 'Pipeline enrolled'}\x1b[0m  ${result.shieldName}`);
+    console.log(`  Mode:    ${result.enforcementMode} · Config: ${savedPath}`);
+    // Same protection stack as laptops. The Claude-format hook covers Claude
+    // Code, VS Code agent mode, and Copilot CLI — the common CI agents.
+    if (args.hooks !== 'false') {
+        console.log('\n\x1b[1mInstalling runtime hook (Claude Code / VS Code / Copilot CLI)…\x1b[0m');
+        const hookArgs = {
+            shieldId: result.shieldId,
+            shieldKey: result.shieldKey,
+            apiUrl,
+            events: 'tools,prompt',
+        };
+        try {
+            await (0, installClaudeHook_1.installClaudeHookCommand)(hookArgs, config);
+            await sendLog([{ level: 'success', message: 'Runtime hook installed (Claude Code / VS Code / Copilot CLI)' }]);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            console.log(`Hook install skipped: ${reason}`);
+            await sendLog([{ level: 'warn', message: `Runtime hook install skipped: ${reason}` }]);
+        }
+    }
+    if (args.gateway !== 'false') {
+        console.log('\n\x1b[1mWrapping MCP client configs with the gateway…\x1b[0m');
+        const gatewayArgs = {
+            shieldId: result.shieldId,
+            shieldKey: result.shieldKey,
+            apiUrl,
+            clients: 'all',
+        };
+        try {
+            await (0, mcpGateway_1.protectAllCommand)(gatewayArgs, config);
+            await sendLog([{ level: 'success', message: 'MCP client configs wrapped with the FullCourtDefense gateway' }]);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            console.log(`MCP gateway wrap skipped: ${reason}`);
+            await sendLog([{ level: 'warn', message: `MCP gateway wrap skipped: ${reason}` }]);
+        }
+    }
+    console.log('\n\x1b[32mDone.\x1b[0m This job\'s AI tool calls are now policy-checked and streamed to the fleet console.');
+    console.log(`Pipeline appears in AI Fleet → Machines → CI pipelines as \x1b[1m${repo} · ${workflow}\x1b[0m.`);
+    await sendLog([{ level: 'success', message: `Protection active (${result.enforcementMode} mode) — this job's AI tool calls are policy-checked and recorded` }], 'succeeded');
+}

package/dist/commands/daemon.js

@@ -1187,6 +1187,8 @@ async function runDaemon(args, config) {
             const result = (0, windowsAudit_1.pruneTranscripts)();
             if (result.pruned > 0)
                 log(`Transcript retention: pruned ${result.pruned} transcript file(s) older than ${(0, windowsAudit_1.transcriptRetentionDays)()} day(s).`);
+            if ((result.prunedBySize || 0) > 0)
+                log(`Transcript retention: pruned ${result.prunedBySize} more transcript file(s) (oldest first) to stay under the ${(0, windowsAudit_1.transcriptMaxMb)()}MB size budget.`);
         }
         catch { /* never let housekeeping hurt the daemon */ }
     };

package/dist/commands/deterministicGuard.js

@@ -258,9 +258,18 @@ function disabled(options) {
 function isEnabled(itemId, options) {
     return !disabled(options).has(itemId);
 }
+/**
+ * Items that WARN by default (catalog-level default action). Applies only when
+ * the snapshot carries no explicit action for the item — an org override to
+ * 'block' ships explicitly in the snapshot and wins. Keeps offline machines
+ * and stale snapshots on the warn-first rollout instead of hard-blocking.
+ */
+const DEFAULT_WARN_BUILT_INS = new Set(['env_workspace']);
 function actionFor(itemId, options) {
     const action = options?.itemActions?.[itemId];
-    return action === 'warn' || action === 'mask' ? action : 'block';
+    if (action === 'warn' || action === 'mask' || action === 'block')
+        return action;
+    return DEFAULT_WARN_BUILT_INS.has(itemId) ? 'warn' : 'block';
 }
 function builtIn(itemId, categoryId, category, ruleId, reason, findingEvidence, explanation, options) {
     if (!isEnabled(itemId, options))
@@ -396,8 +405,14 @@ function containsSensitiveCredentialPath(value) {
         if (check.re.test(text))
             return { itemId: check.itemId, label: check.label };
     }
-    if (traversal && /(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[/?#\s'"])/.test(text)) {
-        return { itemId: 'env_traversal', label: 'environment file via path traversal' };
+    if (/(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[/?#\s'"])/.test(text)) {
+        // Traversal to a .env outside the workspace stays a hard block
+        // (env_traversal); a plain workspace .env is a separate warn-by-default
+        // item (env_workspace) — agents legitimately read it during development,
+        // but the fleet should still see every touch.
+        return traversal
+            ? { itemId: 'env_traversal', label: 'environment file via path traversal' }
+            : { itemId: 'env_workspace', label: 'workspace environment file' };
     }
     return undefined;
 }

package/dist/commands/discover.js

@@ -1097,6 +1097,11 @@ async function discoverCommand(args, config) {
         printAgentFilesReport(agentFiles, silent);
     if (posture)
         printPostureReport(posture, silent);
+    // Explicit scope boundary: a broad security/credential report during an
+    // active incident can reasonably be over-read as endpoint protection.
+    if (!silent) {
+        console.log(`${COLOR.gray}Scope: this discovery inventories AI agents, MCP servers, credentials, and machine posture. It is NOT antivirus/EDR — binaries, running processes, and quarantined files are not scanned. Keep your endpoint protection (e.g. Microsoft Defender) active alongside it.${COLOR.reset}`);
+    }
     if (uploadRequested) {
         console.log('');
         await maybeUpload();

package/dist/commands/hook.js

@@ -47,6 +47,7 @@ const taintLedger_1 = require("./taintLedger");
 const notify_1 = require("../notify");
 const distress_1 = require("../distress");
 const policyGateHealth_1 = require("../policyGateHealth");
+const machineIdentity_1 = require("../machineIdentity");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const DEBUG_LOG = path.join(os.homedir(), '.fullcourtdefense-hook.log');
 /**
@@ -533,7 +534,16 @@ function machineMetadata(client = 'cursor') {
         username = os.userInfo().username;
     }
     catch { /* ignore */ }
+    // Stable fleet machine identity: lets the backend attribute this decision to
+    // THIS machine exactly (timeline + behavior baseline), instead of matching
+    // by hostname. Best-effort — identity must never break the hook.
+    let machineId;
+    try {
+        machineId = (0, machineIdentity_1.getMachineIdentity)().machineId;
+    }
+    catch { /* ignore */ }
     return {
+        ...(machineId ? { machineId } : {}),
         developerName: developerId(),
         machineName: os.hostname(),
         os: `${os.platform()} ${os.release()}`,

package/dist/commands/installAll.js

@@ -44,7 +44,8 @@ async function installAllCommand(args, config) {
             // Prompt secrets are checked locally; prompt text never leaves the machine.
             // No failClosed flag: the offline stance is server-authoritative (from
             // the runtime bundle), unified with the Claude/VS Code hook below.
-            events: 'prompt,shell,mcp',
+            // file + read close the "agent reads ~/.aws/credentials silently" hole.
+            events: 'prompt,shell,mcp,file,read',
         };
         try {
             await (0, installCursorHook_1.installCursorHookCommand)(hookArgs, config);
@@ -72,9 +73,11 @@ async function installAllCommand(args, config) {
     }
     // Windows-wide command auditing — PowerShell ScriptBlock Logging + Transcription.
     // Covers commands typed in ANY PowerShell (inside or outside the IDE), not just
-    // agent-driven actions. Requires ONE admin (UAC) approval; failure is a warning,
-    // never an install blocker — missing coverage shows on the fleet dashboard.
-    if (process.platform === 'win32' && args.windowsAudit !== 'false') {
+    // agent-driven actions. OFF BY DEFAULT: it flips machine-wide HKLM policy and
+    // transcription writes sizeable plaintext logs to ProgramData — that footprint
+    // is an explicit opt-in (--windows-audit true, or org policy), not a side
+    // effect of installing protection. Requires ONE admin (UAC) approval.
+    if (process.platform === 'win32' && args.windowsAudit === 'true') {
         console.log('\n\x1b[1mEnabling Windows PowerShell audit logging (ScriptBlock Logging + Transcription)…\x1b[0m');
         try {
             const current = (0, windowsAudit_1.getWindowsAuditStatus)();
@@ -97,6 +100,9 @@ async function installAllCommand(args, config) {
             console.log(`\x1b[33m⚠ Warning: PowerShell audit logging step failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
         }
     }
+    else if (process.platform === 'win32' && args.windowsAudit !== 'false') {
+        console.log('\n\x1b[2mPowerShell audit logging (ScriptBlock Logging + Transcription) is OFF by default — it changes machine-wide policy and writes command transcripts to disk. Opt in with --windows-audit true, or later via: fullcourtdefense windows-audit --enable true\x1b[0m');
+    }
     // Interactive PowerShell guard — blocks dangerous commands TYPED in a
     // terminal (inside or outside the IDE) using the same rule families the IDE
     // hooks enforce, from the local cache (no admin needed, no network hot path).

package/dist/commands/installCursorHook.js

@@ -147,7 +147,7 @@ function repairCursorManagedHooks() {
     const json = readHooksJson(before.file);
     let changed = false;
     if (before.managedEntries === 0) {
-        for (const event of ['prompt', 'shell', 'mcp']) {
+        for (const event of ['prompt', 'shell', 'mcp', 'file', 'read']) {
             const { hookKey, flag, timeoutSec } = EVENT_MAP[event];
             const list = Array.isArray(json.hooks[hookKey]) ? json.hooks[hookKey] : [];
             list.push({
@@ -218,7 +218,11 @@ async function installCursorHookCommand(args, config) {
     const projectScope = args.project === 'true';
     const shadow = args.shadow === 'true';
     const file = hooksJsonPath(projectScope);
-    const requested = (args.events || 'prompt,shell,mcp')
+    // file + read are in the default set: without them a Cursor agent can read
+    // ~/.aws/credentials or write a poisoned config with no hook ever firing —
+    // the exact coverage hole customers assume is closed. Opt out with
+    // --events prompt,shell,mcp.
+    const requested = (args.events || 'prompt,shell,mcp,file,read')
         .split(/[\s,]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
     const events = requested.filter((e) => EVENT_MAP[e]);
     if (events.length === 0) {

package/dist/commands/mcpGateway.js

@@ -63,6 +63,8 @@ const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const distress_1 = require("../distress");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
+const machineIdentity_1 = require("../machineIdentity");
+const backupManifest_1 = require("../backupManifest");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
 const INSTALL_GATEWAY_ARGS = { includeShieldKey: false };
@@ -230,7 +232,15 @@ function resolveGatewayConfig(args, config, defaults = {}) {
 }
 function machineMetadata(developerName, agentClient = 'cursor') {
     const sessionId = runtimeSessionId();
+    // Exact fleet machine attribution for the backend's runtime decision mirror
+    // (timeline + behavior baseline). Best-effort — never break the gateway.
+    let machineId;
+    try {
+        machineId = (0, machineIdentity_1.getMachineIdentity)().machineId;
+    }
+    catch { /* ignore */ }
     return {
+        ...(machineId ? { machineId } : {}),
         developerName: developerName || machineScopedUser(),
         machineName: os.hostname(),
         os: `${os.platform()} ${os.release()}`,
@@ -1621,6 +1631,9 @@ function backupFile(file) {
     try {
         const bak = `${file}.fcd-backup-${Date.now()}`;
         fs.copyFileSync(file, bak);
+        // Backups can embed live credentials and land in project-local dirs no
+        // scan can enumerate — record each one so uninstall can delete them all.
+        (0, backupManifest_1.recordConfigBackup)(bak);
     }
     catch { /* best effort */ }
 }

package/dist/commands/onboard.d.ts

@@ -15,6 +15,8 @@ export interface OnboardArgs extends InstallAllArgs {
     json?: string;
     /** Do not enable optional self-healing protection. */
     noDaemon?: string;
+    /** 'true' => skip the interactive trust disclosure (automation/MDM; the MSI consents via its own dialog). */
+    acceptDisclosure?: string;
 }
 /**
  * `fullcourtdefense onboard` — the one-command path from a fresh machine to a

package/dist/commands/onboard.js

@@ -63,6 +63,50 @@ const YELLOW = '\x1b[33m';
 const BOLD = '\x1b[1m';
 const DIM = '\x1b[2m';
 const RESET = '\x1b[0m';
+/**
+ * The trust disclosure — the npm/CLI twin of the MSI EnrollmentDlg text
+ * (FullCourtDefense.wxs). A user installing from npm must see the same trust
+ * boundary the Windows installer shows BEFORE anything touches the machine:
+ * what gets installed, what runs in the background, and what data leaves the
+ * device. Keep both texts in sync when either changes.
+ *
+ * Consent model: interactive terminals must confirm; `--accept-disclosure
+ * true` / FCD_ACCEPT_DISCLOSURE=1 skip the prompt for automation and MDM;
+ * non-interactive runs (MSI custom action — consent was the Install click)
+ * print the text and continue, because a hidden prompt would hang the install.
+ * Returns false when the user explicitly declined.
+ */
+async function confirmTrustDisclosure(args) {
+    console.log(`${BOLD}Before continuing, understand what FullCourtDefense sets up on this machine:${RESET}`);
+    console.log(`${DIM}  - background protection tasks (resident daemon + watchdog) that start with your session`);
+    console.log('  - IDE/terminal hooks, and MCP tool traffic routed through a local security gateway');
+    console.log("  - agent/tool activity (commands, tool-call argument summaries) sent to your organization's");
+    console.log('    FullCourtDefense console for policy decisions and audit');
+    console.log('  - intended for organization-managed devices');
+    console.log(`  - removed with \`fullcourtdefense uninstall\`${process.platform === 'win32' ? ' (MSI installs: Windows Settings > Apps)' : ''}${RESET}`);
+    console.log('');
+    const accepted = args.acceptDisclosure === 'true'
+        || process.env.FCD_ACCEPT_DISCLOSURE === '1'
+        || process.env.FCD_ACCEPT_DISCLOSURE === 'true';
+    if (accepted) {
+        console.log(`${DIM}Disclosure accepted via --accept-disclosure / FCD_ACCEPT_DISCLOSURE.${RESET}\n`);
+        return true;
+    }
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        // Non-interactive (MSI custom action, CI, MDM) — consent happened upstream
+        // (installer dialog / management policy); prompting here would hang.
+        console.log(`${DIM}Non-interactive run — continuing (pass --accept-disclosure true to make consent explicit in automation).${RESET}\n`);
+        return true;
+    }
+    const readline = await Promise.resolve().then(() => __importStar(require('readline')));
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise(resolve => {
+        rl.question(`${BOLD}Continue? [y/N] ${RESET}`, resolve);
+    });
+    rl.close();
+    console.log('');
+    return /^y(es)?$/i.test(answer.trim());
+}
 function printCheck(check) {
     const mark = check.ok ? `${GREEN}✓${RESET}` : check.optional ? `${YELLOW}○${RESET}` : `${RED}✗${RESET}`;
     const detail = check.detail ? ` ${DIM}${check.detail}${RESET}` : '';
@@ -193,10 +237,10 @@ function checkTerminalGuards() {
         const audit = (0, windowsAudit_1.getWindowsAuditStatus)();
         const auditOk = audit.scriptBlockLogging && audit.transcription;
         checks.push({
-            label: 'PowerShell audit logging',
+            label: 'PowerShell audit logging (opt-in)',
             ok: auditOk,
             optional: true,
-            detail: auditOk ? undefined : 'run windows-audit --enable true (needs one UAC approval)',
+            detail: auditOk ? undefined : 'off by default — enable with windows-audit --enable true (one UAC approval; writes transcripts to ProgramData)',
         });
     }
     else {
@@ -234,6 +278,13 @@ async function onboardCommand(args, config) {
     };
     console.log(`\n${BOLD}\x1b[36mFullCourtDefense — machine onboarding${RESET}`);
     console.log(`${DIM}Connectivity -> enrollment -> protection -> verification. One command.${RESET}\n`);
+    // Trust disclosure first — nothing touches the machine before consent.
+    // Dry runs report the plan without changing anything, so no prompt there.
+    if (!dryRun && !(await confirmTrustDisclosure(args))) {
+        console.log(`${YELLOW}Onboarding cancelled — nothing was installed or changed on this machine.${RESET}`);
+        process.exitCode = 1;
+        return;
+    }
     // Onboarding is a persisted transaction: completed steps are reused on any
     // re-run, so `--resume` is an explicit alias that also surfaces the journal.
     const resume = args.resume === 'true' || args.resume === '';