fullcourtdefense-cli 1.3.1 → 1.3.3

package/dist/api.d.ts

@@ -91,6 +91,14 @@ export interface ApiError {
     code?: string;
     remaining?: number;
 }
+export interface SetupValidationResponse {
+    organizationId: string;
+    organizationName: string;
+    shieldId: string;
+    shieldName: string;
+    shieldKeyRequired: boolean;
+    gatewayMode: boolean;
+}
 export declare class BotGuardApi {
     private apiUrl;
     private apiKey;
@@ -100,4 +108,9 @@ export declare class BotGuardApi {
     getScanStatus(jobId: string): Promise<AsyncJobResponse>;
     pollUntilDone(jobId: string, intervalMs?: number, maxWaitMs?: number): Promise<ScanResult>;
     getCredits(): Promise<CreditsResponse>;
+    validateSetup(input: {
+        organizationId?: string;
+        shieldId: string;
+        shieldKey?: string;
+    }): Promise<SetupValidationResponse>;
 }

package/dist/api.js

@@ -19,10 +19,26 @@ class BotGuardApi {
             },
             body: body ? JSON.stringify(body) : undefined,
         });
-        const data = await resp.json();
+        const contentType = resp.headers.get('content-type') || '';
+        const raw = await resp.text();
+        let data;
+        try {
+            data = raw ? JSON.parse(raw) : {};
+        }
+        catch {
+            if (raw.trimStart().startsWith('<!DOCTYPE') || raw.trimStart().startsWith('<html')) {
+                throw new Error(`API returned HTML instead of JSON (${resp.status} ${path}). `
+                    + 'The endpoint may not be deployed yet — retry with `fullcourtdefense setup --skip-validate true` '
+                    + 'or confirm https://api.fullcourtdefense.ai is reachable.');
+            }
+            throw new Error(`Invalid API response (${resp.status} ${path}): ${raw.slice(0, 200)}`);
+        }
+        if (!contentType.includes('json') && !data?.success && !resp.ok) {
+            // Some gateways omit content-type; JSON parse already succeeded.
+        }
         if (!resp.ok || data.success === false) {
             const err = data;
-            const msg = err.error || `API error (${resp.status})`;
+            const msg = err.code ? `${err.error} (${err.code})` : (err.error || `API error (${resp.status})`);
             if (err.code === 'CREDITS_EXHAUSTED') {
                 throw new Error(`No scan credits remaining this month. Upgrade your plan at https://fullcourtdefense.ai/pricing`);
             }
@@ -58,5 +74,8 @@ class BotGuardApi {
     async getCredits() {
         return this.request('GET', '/api/cicd/credits');
     }
+    async validateSetup(input) {
+        return this.request('POST', '/api/cicd/setup/validate', input);
+    }
 }
 exports.BotGuardApi = BotGuardApi;

package/dist/commands/configure.d.ts

@@ -1,7 +1,10 @@
 import { BotGuardConfig } from '../config';
 export interface ConfigureArgs {
+    apiKey?: string;
+    organizationId?: string;
     shieldId?: string;
     shieldKey?: string;
     apiUrl?: string;
+    skipValidate?: boolean;
 }
 export declare function configureCommand(args: ConfigureArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/configure.js

@@ -36,25 +36,70 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureCommand = configureCommand;
 const readline = __importStar(require("readline/promises"));
 const process_1 = require("process");
+const api_1 = require("../api");
 const config_1 = require("../config");
 async function ask(rl, question, fallback) {
     const suffix = fallback ? ` (${fallback})` : '';
     const answer = (await rl.question(`${question}${suffix}: `)).trim();
     return answer || fallback || '';
 }
+function resolveApiKey(args, config) {
+    return args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY || '';
+}
 async function configureCommand(args, config) {
-    const rl = readline.createInterface({ input: process_1.stdin, output: process_1.stdout });
-    try {
-        const shieldId = args.shieldId || await ask(rl, 'Shield ID', config.shieldId || 'sh_...');
-        if (!shieldId || shieldId === 'sh_...') {
-            throw new Error('Shield ID is required.');
+    const apiUrl = args.apiUrl || config.apiUrl || 'https://api.fullcourtdefense.ai';
+    const apiKey = resolveApiKey(args, config);
+    const organizationId = args.organizationId || config.organizationId;
+    const shieldId = args.shieldId || config.shieldId;
+    const shieldKey = args.shieldKey ?? config.shieldKey;
+    const hasAllRequired = Boolean(apiKey && organizationId && shieldId);
+    let finalApiUrl = apiUrl;
+    let finalApiKey = apiKey;
+    let finalOrgId = organizationId;
+    let finalShieldId = shieldId;
+    let finalShieldKey = shieldKey;
+    if (!hasAllRequired) {
+        const rl = readline.createInterface({ input: process_1.stdin, output: process_1.stdout });
+        try {
+            finalApiUrl = args.apiUrl || await ask(rl, 'FullCourtDefense API URL', config.apiUrl || 'https://api.fullcourtdefense.ai');
+            finalApiKey = resolveApiKey(args, config) || await ask(rl, 'Organization API key (from Settings → API Keys)', '');
+            finalOrgId = args.organizationId || await ask(rl, 'Organization ID (from Settings → Organization)', config.organizationId || '');
+            finalShieldId = args.shieldId || await ask(rl, 'Shield ID', config.shieldId || 'sh_...');
+            finalShieldKey = args.shieldKey ?? await ask(rl, 'Shield key if locked, blank if not required', config.shieldKey || '');
+        }
+        finally {
+            rl.close();
         }
-        const shieldKey = args.shieldKey || await ask(rl, 'Shield key if locked, blank if not required', config.shieldKey || '');
-        const apiUrl = args.apiUrl || await ask(rl, 'FullCourtDefense API URL', config.apiUrl || 'https://api.fullcourtdefense.ai');
-        const savedPath = (0, config_1.saveShieldConfig)({ shieldId, shieldKey: shieldKey || undefined, apiUrl });
-        console.log(`Saved Shield config to ${savedPath}`);
     }
-    finally {
-        rl.close();
+    if (!finalApiKey) {
+        throw new Error('Organization API key is required to validate your setup.');
+    }
+    if (!finalOrgId) {
+        throw new Error('Organization ID is required.');
+    }
+    if (!finalShieldId || finalShieldId === 'sh_...') {
+        throw new Error('Shield ID is required.');
+    }
+    if (args.skipValidate !== true) {
+        console.log('Validating organization, Shield ID, and Shield key against FullCourtDefense...');
+        const api = new api_1.BotGuardApi(finalApiKey, finalApiUrl);
+        const validated = await api.validateSetup({
+            organizationId: finalOrgId,
+            shieldId: finalShieldId,
+            shieldKey: finalShieldKey || undefined,
+        });
+        if (validated.organizationId !== finalOrgId) {
+            throw new Error(`Organization mismatch: API key belongs to "${validated.organizationName}" (${validated.organizationId}), not "${finalOrgId}".`);
+        }
+        console.log(`Verified: ${validated.organizationName} → Shield "${validated.shieldName}" (${validated.shieldId})`);
     }
+    const savedPath = (0, config_1.saveSetupConfig)({
+        apiKey: finalApiKey,
+        organizationId: finalOrgId,
+        shieldId: finalShieldId,
+        shieldKey: finalShieldKey || undefined,
+        apiUrl: finalApiUrl,
+    });
+    console.log(`Saved setup to ${savedPath}`);
+    console.log('All other CLI commands (install, discover --upload, scan, hooks) will use these credentials automatically.');
 }

package/dist/commands/discover.d.ts

@@ -1,6 +1,8 @@
 import { BotGuardConfig } from '../config';
+export type DiscoverSurface = 'mcp' | 'secrets' | 'agent-files' | 'posture';
 export interface DiscoverArgs {
     type?: string;
+    surface?: string;
     apiKey?: string;
     apiUrl?: string;
     json?: string;

package/dist/commands/discover.js

@@ -38,11 +38,29 @@ exports.runDiscoverUpload = runDiscoverUpload;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
+const config_1 = require("../config");
 const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
 const discoverPaths_1 = require("./discoverPaths");
 const knownMcpServers_1 = require("./knownMcpServers");
+const discoverAgentFiles_1 = require("./discoverAgentFiles");
+const discoverBlastRadius_1 = require("./discoverBlastRadius");
+const discoverSecrets_1 = require("./discoverSecrets");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
+function parseSurfaces(args) {
+    const raw = (args.surface || args.type || 'mcp').toLowerCase().trim();
+    if (raw === 'all' || raw === 'full') {
+        return new Set(['mcp', 'secrets', 'agent-files', 'posture']);
+    }
+    const allowed = ['mcp', 'secrets', 'agent-files', 'posture'];
+    const picked = raw.split(',').map(part => part.trim()).filter(Boolean);
+    const surfaces = new Set();
+    for (const part of picked) {
+        if (allowed.includes(part))
+            surfaces.add(part);
+    }
+    return surfaces.size > 0 ? surfaces : new Set(['mcp']);
+}
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
 function machineFingerprint() {
@@ -333,11 +351,50 @@ function proxyStatusLabel(status) {
         return 'Direct — needs gateway';
     return 'Unknown';
 }
-async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName) {
+function sanitizeSecretForUpload(finding) {
+    return {
+        id: finding.id,
+        category: finding.category,
+        severity: finding.severity,
+        provider: finding.provider,
+        filePath: finding.filePath,
+        lineNumber: finding.lineNumber,
+        title: finding.title,
+        detail: finding.detail,
+        redactedPreview: finding.redactedPreview,
+        remediation: finding.remediation,
+    };
+}
+function sanitizeAgentFileForUpload(finding) {
+    return {
+        id: finding.id,
+        kind: finding.kind,
+        client: finding.client,
+        filePath: finding.filePath,
+        title: finding.title,
+        sizeBytes: finding.sizeBytes,
+        lineCount: finding.lineCount,
+        riskTags: finding.riskTags,
+        excerpt: finding.excerpt,
+    };
+}
+async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName, extras) {
     const payload = {
         connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
         host,
         clientCoverage,
+        posture: extras?.posture ? {
+            score: extras.posture.score,
+            grade: extras.posture.grade,
+            drivers: extras.posture.drivers,
+            combos: extras.posture.combos,
+            secretsHealthScore: extras.secrets?.healthScore,
+            secretsCritical: extras.secrets?.findings.filter(f => f.severity === 'critical').length ?? 0,
+            secretsHigh: extras.secrets?.findings.filter(f => f.severity === 'high').length ?? 0,
+            agentFilesCount: extras.agentFiles?.length ?? 0,
+        } : undefined,
+        secrets: extras?.secrets?.findings.slice(0, 100).map(sanitizeSecretForUpload),
+        agentFiles: extras?.agentFiles?.slice(0, 100).map(sanitizeAgentFileForUpload),
         servers: servers.map(s => ({
             serverName: s.serverName,
             command: s.command,
@@ -366,10 +423,71 @@ async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorNa
         throw new Error(data.error || `Upload failed (${resp.status})`);
     }
     const ingested = data.data?.ingested ?? servers.length;
-    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory.${COLOR.reset}`);
+    const postureNote = extras?.posture ? ` · machine score ${extras.posture.score}/100 (${extras.posture.grade})` : '';
+    console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory${postureNote}.${COLOR.reset}`);
+}
+function printSecretsReport(secrets, silent) {
+    if (silent)
+        return;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Secrets & exposure${COLOR.reset}`);
+    console.log(`${COLOR.gray}Scanned ${secrets.scannedFiles} file(s) and ${secrets.scannedStores} credential store(s). Health ${secrets.healthScore}/100.${COLOR.reset}\n`);
+    if (secrets.findings.length === 0) {
+        console.log(`${COLOR.green}No obvious leaked secrets in scanned locations.${COLOR.reset}`);
+        return;
+    }
+    for (const f of secrets.findings.slice(0, 40)) {
+        const col = f.severity === 'critical' || f.severity === 'high' ? COLOR.red : f.severity === 'medium' ? COLOR.yellow : COLOR.gray;
+        console.log(`  ${col}[${f.severity.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${f.title}${COLOR.reset} ${COLOR.gray}(${f.category})${COLOR.reset}`);
+        console.log(`        ${COLOR.gray}path:${COLOR.reset} ${f.filePath}${f.lineNumber ? `:${f.lineNumber}` : ''}`);
+        if (f.redactedPreview)
+            console.log(`        ${COLOR.gray}preview:${COLOR.reset} ${f.redactedPreview}`);
+        console.log(`        ${COLOR.gray}fix:${COLOR.reset} ${f.remediation}`);
+        console.log('');
+    }
+    if (secrets.findings.length > 40) {
+        console.log(`${COLOR.gray}… and ${secrets.findings.length - 40} more (use --json for full list).${COLOR.reset}`);
+    }
+}
+function printAgentFilesReport(files, silent) {
+    if (silent)
+        return;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Agent files (rules / skills / instructions)${COLOR.reset}`);
+    console.log(`${COLOR.gray}Found ${files.length} file(s) that shape agent behavior on this machine.${COLOR.reset}\n`);
+    if (files.length === 0) {
+        console.log(`${COLOR.yellow}No Cursor rules, AGENTS.md, CLAUDE.md, or skill files found in home or project.${COLOR.reset}`);
+        return;
+    }
+    for (const f of files.slice(0, 30)) {
+        console.log(`  ${COLOR.bold}${f.title}${COLOR.reset} ${COLOR.gray}(${f.kind}${f.client ? ` · ${f.client}` : ''})${COLOR.reset}`);
+        console.log(`        ${COLOR.gray}path:${COLOR.reset} ${f.filePath} · ${f.lineCount} lines`);
+        if (f.riskTags.length)
+            console.log(`        ${COLOR.red}tags:${COLOR.reset} ${f.riskTags.join(', ')}`);
+        if (f.excerpt)
+            console.log(`        ${COLOR.gray}excerpt:${COLOR.reset} ${f.excerpt}${f.excerpt.length >= 180 ? '…' : ''}`);
+        console.log('');
+    }
+}
+function printPostureReport(posture, silent) {
+    if (silent)
+        return;
+    const col = posture.score >= 80 ? COLOR.green : posture.score >= 60 ? COLOR.yellow : COLOR.red;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}Machine blast radius${COLOR.reset}`);
+    console.log(`${col}${COLOR.bold}Score ${posture.score}/100 · Grade ${posture.grade}${COLOR.reset}`);
+    if (posture.drivers.length)
+        console.log(`${COLOR.gray}Drivers: ${posture.drivers.join(' · ')}${COLOR.reset}`);
+    if (posture.combos.length === 0) {
+        console.log(`${COLOR.green}No dangerous MCP combos detected.${COLOR.reset}`);
+        return;
+    }
+    console.log('');
+    for (const combo of posture.combos) {
+        const c = combo.severity === 'critical' ? COLOR.red : combo.severity === 'high' ? COLOR.yellow : COLOR.gray;
+        console.log(`  ${c}[${combo.severity.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${combo.title}${COLOR.reset}`);
+        console.log(`        ${combo.detail}`);
+    }
 }
 async function discoverCommand(args, config) {
-    const type = (args.type || 'mcp').toLowerCase();
+    const surfaces = parseSurfaces(args);
     const silent = args.silent === 'true';
     const deep = args.deep === 'true';
     if (args.unschedule === 'true') {
@@ -387,141 +505,139 @@ async function discoverCommand(args, config) {
         }
         return;
     }
-    if (type !== 'mcp') {
-        if (!silent)
-            console.error(`Unsupported discover type "${type}". Supported: mcp`);
-        process.exit(1);
-    }
     const cwd = process.cwd();
-    const candidates = candidateConfigPaths(cwd, args.extraPath);
+    const runMcp = surfaces.has('mcp');
     const scanned = [];
     let found = [];
-    for (const c of candidates) {
-        scanned.push({ path: c.path, source: c.source });
-        if (fs.existsSync(c.path)) {
-            found.push(...parseConfigFile(c.path, c.source));
+    let clientCoverage = [];
+    if (runMcp) {
+        const candidates = candidateConfigPaths(cwd, args.extraPath);
+        for (const c of candidates) {
+            scanned.push({ path: c.path, source: c.source });
+            if (fs.existsSync(c.path)) {
+                found.push(...parseConfigFile(c.path, c.source));
+            }
+        }
+        found = dedupe(found);
+        clientCoverage = applyProxyClassification(found, scanned, cwd);
+        if (deep && found.length > 0) {
+            if (!silent)
+                console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
+            await enrichWithDeepProbe(found, silent);
         }
     }
-    found = dedupe(found);
-    const clientCoverage = applyProxyClassification(found, scanned, cwd);
-    if (deep && found.length > 0) {
-        if (!silent)
-            console.log(`${COLOR.gray}Running deep probe (HTTP/SSE tools/list)…${COLOR.reset}`);
-        await enrichWithDeepProbe(found, silent);
-    }
+    const secrets = surfaces.has('secrets') || surfaces.has('posture')
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd })
+        : undefined;
+    const agentFiles = surfaces.has('agent-files') || surfaces.has('posture')
+        ? (0, discoverAgentFiles_1.scanAgentFiles)({ cwd })
+        : undefined;
+    const posture = surfaces.has('posture')
+        ? (0, discoverBlastRadius_1.computeBlastRadius)({
+            mcpServers: found,
+            clientCoverage,
+            secrets: secrets || { findings: [], scannedFiles: 0, scannedStores: 0, healthScore: 100 },
+            agentFiles: agentFiles || [],
+        })
+        : undefined;
     const host = buildHostMetadata(args.userEmail, deep && found.some(s => s.probeMode === 'deep') ? 'deep' : 'config');
     if (args.json === 'true') {
         console.log(JSON.stringify({
             host,
+            surfaces: [...surfaces],
             scannedFiles: scanned.map(s => `${s.source} → ${s.path}`),
             clientCoverage,
             servers: found,
+            secrets,
+            agentFiles,
+            posture,
         }, null, 2));
         return;
     }
+    const uploadExtras = { secrets, agentFiles, posture };
+    async function maybeUpload() {
+        if (args.upload !== 'true')
+            return;
+        const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
+        if (!creds.apiKey) {
+            if (!silent) {
+                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset} Run \`fullcourtdefense setup\` first.`);
+            }
+            process.exit(1);
+        }
+        await upload(found, host, clientCoverage, creds.apiUrl, creds.apiKey, args.connectorName, uploadExtras);
+    }
     if (silent) {
         if (args.upload === 'true') {
-            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-            if (!apiKey)
+            const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
+            if (!creds.apiKey)
                 process.exit(1);
-            if (scanned.length === 0)
+            if (!runMcp && !secrets && !agentFiles && !posture)
                 return;
-            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+            await maybeUpload();
         }
         return;
     }
-    console.log(`\n${COLOR.bold}${COLOR.cyan}MCP server discovery${COLOR.reset}`);
-    console.log(`${COLOR.gray}Host ${host.hostname} · ${host.platform} · machine ${host.machineId}${COLOR.reset}`);
-    console.log(`${COLOR.gray}Scanned ${candidates.length} known config locations on this machine.${COLOR.reset}\n`);
-    if (scanned.length === 0) {
-        console.log(`${COLOR.yellow}No MCP config files found.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Looked in Cursor, Claude Desktop/Code, VS Code, Windsurf, Codex, Gemini CLI, and repo-root configs.${COLOR.reset}`);
-        return;
-    }
-    console.log(`${COLOR.bold}AI clients checked (${scanned.length}):${COLOR.reset}`);
-    for (const s of scanned) {
-        const exists = fs.existsSync(s.path);
-        console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
-    }
-    console.log('');
-    if (clientCoverage.length > 0) {
-        console.log(`${COLOR.bold}Client coverage:${COLOR.reset}`);
-        for (const row of clientCoverage) {
-            const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
-            const hooks = row.clientKey === 'cursor'
-                ? (row.cursorHooksInstalled ? `${COLOR.green}hooks ✓ (${row.cursorHookEvents.join(', ')})${COLOR.reset}` : `${COLOR.yellow}no hooks${COLOR.reset}`)
-                : '';
-            console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}${hooks ? ` · ${hooks}` : ''}`);
-            if (row.clientKey === 'claude_desktop' && !row.mcpGatewayInstalled && row.mcpServerCount === 0) {
-                console.log(`        ${COLOR.gray}Install: fullcourtdefense install-claude-desktop-mcp-gateway --shield-id ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
-            }
+    const title = surfaces.size === 1 && surfaces.has('mcp')
+        ? 'MCP server discovery'
+        : `Desktop AI posture (${[...surfaces].join(', ')})`;
+    console.log(`\n${COLOR.bold}${COLOR.cyan}${title}${COLOR.reset}`);
+    console.log(`${COLOR.gray}Host ${host.hostname} · ${host.platform} · machine ${host.machineId}${COLOR.reset}\n`);
+    if (runMcp) {
+        console.log(`${COLOR.bold}MCP inventory${COLOR.reset}`);
+        if (scanned.length === 0) {
+            console.log(`${COLOR.yellow}No MCP config files found.${COLOR.reset}\n`);
         }
-        console.log('');
-    }
-    if (found.length === 0) {
-        console.log(`${COLOR.yellow}No MCP servers configured in these clients yet.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Install gateway everywhere: fullcourtdefense install-mcp-gateway --clients all --shield-id ... --shield-key ... --mcp-command npm --mcp-args "run mcp"${COLOR.reset}`);
-        if (args.upload === 'true') {
-            const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-            const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-            if (!apiKey) {
-                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset}`);
-                process.exit(1);
+        else {
+            console.log(`${COLOR.gray}Scanned ${scanned.length} known config locations.${COLOR.reset}\n`);
+            for (const s of scanned) {
+                const exists = fs.existsSync(s.path);
+                console.log(`  ${COLOR.dim}•${COLOR.reset} ${s.source} → ${s.path}${exists ? '' : ` ${COLOR.yellow}(not created yet)${COLOR.reset}`}`);
             }
             console.log('');
-            await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
-        }
-        else {
-            console.log(`${COLOR.gray}Run with --upload to push client coverage into AI Inventory.${COLOR.reset}`);
-        }
-        return;
-    }
-    const order = { critical: 0, high: 1, medium: 2, low: 3 };
-    found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
-    console.log(`${COLOR.bold}${found.length} MCP server(s) discovered:${COLOR.reset}\n`);
-    for (const s of found) {
-        const col = riskColor(s.riskLevel);
-        const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
-        const proxyCol = s.proxyStatus === 'direct' ? COLOR.red : s.proxyStatus === 'proxied' || s.proxyStatus === 'fcd_gateway' ? COLOR.green : COLOR.yellow;
-        console.log(`  ${col}${COLOR.bold}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${COLOR.bold}${s.serverName}${COLOR.reset} ${COLOR.gray}(${s.transport}${s.probeMode === 'deep' ? ', deep' : ''})${COLOR.reset} ${proxyCol}${proxyStatusLabel(s.proxyStatus)}${COLOR.reset}`);
-        if (s.serverDescription)
-            console.log(`        ${COLOR.gray}about:${COLOR.reset} ${s.serverDescription}`);
-        console.log(`        ${COLOR.gray}target:${COLOR.reset} ${target}`);
-        if (s.riskTags.length)
-            console.log(`        ${COLOR.gray}tags:${COLOR.reset} ${s.riskTags.join(', ')}`);
-        if (s.tools.length) {
-            const names = s.tools.map(t => t.name);
-            console.log(`        ${COLOR.gray}tools:${COLOR.reset} ${names.slice(0, 12).join(', ')}${names.length > 12 ? ' …' : ''}`);
+            if (clientCoverage.length > 0) {
+                for (const row of clientCoverage) {
+                    const gateway = row.mcpGatewayInstalled ? `${COLOR.green}gateway ✓${COLOR.reset}` : `${COLOR.red}no gateway${COLOR.reset}`;
+                    console.log(`  ${COLOR.dim}•${COLOR.reset} ${row.client} — ${row.mcpServerCount} MCP · ${gateway}`);
+                }
+                console.log('');
+            }
+            if (found.length > 0) {
+                const order = { critical: 0, high: 1, medium: 2, low: 3 };
+                found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
+                for (const s of found) {
+                    const col = riskColor(s.riskLevel);
+                    const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
+                    console.log(`  ${col}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${s.serverName} — ${target} (${proxyStatusLabel(s.proxyStatus)})`);
+                }
+                console.log('');
+            }
         }
-        console.log(`        ${COLOR.gray}from:${COLOR.reset} ${s.source}`);
-        for (const w of s.warnings)
-            console.log(`        ${COLOR.red}⚠ ${w}${COLOR.reset}`);
-        console.log('');
     }
-    const counts = found.reduce((acc, s) => { acc[s.riskLevel] = (acc[s.riskLevel] || 0) + 1; return acc; }, {});
-    console.log(`${COLOR.bold}Summary:${COLOR.reset} ${counts.critical || 0} critical · ${counts.high || 0} high · ${counts.medium || 0} medium · ${counts.low || 0} low`);
+    if (secrets)
+        printSecretsReport(secrets, silent);
+    if (agentFiles)
+        printAgentFilesReport(agentFiles, silent);
+    if (posture)
+        printPostureReport(posture, silent);
     if (args.upload === 'true') {
-        const apiKey = args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY;
-        const apiUrl = args.apiUrl || config.apiUrl || DEFAULT_API_URL;
-        if (!apiKey) {
-            console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset} Set --api-key, FULLCOURTDEFENSE_API_KEY, or apiKey in config.`);
-            process.exit(1);
-        }
         console.log('');
-        await upload(found, host, clientCoverage, apiUrl, apiKey, args.connectorName);
+        await maybeUpload();
     }
     else {
-        console.log(`${COLOR.gray}Run with --upload to push these into your AI Inventory.${COLOR.reset}`);
-        if (!deep)
-            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE servers for tools/list.${COLOR.reset}`);
-        console.log(`${COLOR.gray}Add --schedule daily for automatic daily upload (MDM/fleet).${COLOR.reset}`);
+        console.log(`${COLOR.gray}Run with --upload to push results into AI Fleet.${COLOR.reset}`);
+        if (runMcp && !deep)
+            console.log(`${COLOR.gray}Add --deep to live-probe HTTP/SSE MCP servers.${COLOR.reset}`);
+        if (!surfaces.has('secrets'))
+            console.log(`${COLOR.gray}Add --surface secrets for .env / credential store scan (local-only).${COLOR.reset}`);
+        if (surfaces.size < 4)
+            console.log(`${COLOR.gray}Add --surface all for MCP + secrets + agent files + blast radius.${COLOR.reset}`);
     }
 }
 /** Upload-only discover — used after install-mcp-gateway --upload. */
 async function runDiscoverUpload(args, config) {
     await discoverCommand({
-        type: 'mcp',
+        surface: 'all',
         upload: 'true',
         silent: args.silent ? 'true' : undefined,
         apiKey: args.apiKey,

package/dist/commands/discoverAgentFiles.d.ts

@@ -0,0 +1,15 @@
+export type AgentFileKind = 'rules' | 'skills' | 'instructions' | 'hooks' | 'memory' | 'other';
+export interface AgentFileFinding {
+    id: string;
+    kind: AgentFileKind;
+    client?: string;
+    filePath: string;
+    title: string;
+    sizeBytes: number;
+    lineCount: number;
+    riskTags: string[];
+    excerpt?: string;
+}
+export declare function scanAgentFiles(options?: {
+    cwd?: string;
+}): AgentFileFinding[];