fullcourtdefense-cli 1.5.3 → 1.6.0

package/dist/commands/autoProtect.d.ts

@@ -0,0 +1,10 @@
+import { BotGuardConfig } from '../config';
+import { ProtectAllArgs } from './mcpGateway';
+export interface AutoProtectArgs extends ProtectAllArgs {
+    install?: string;
+    uninstall?: string;
+    status?: string;
+    intervalMinutes?: string;
+    onLogon?: string;
+}
+export declare function autoProtectCommand(args: AutoProtectArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/autoProtect.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.autoProtectCommand = autoProtectCommand;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const mcpGateway_1 = require("./mcpGateway");
+const COLOR = {
+    reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+    red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
+};
+const TASK_NAME = 'FullCourtDefense Auto-Protect';
+const CRON_MARKER = '# FCD_AUTO_PROTECT';
+function cliEntry() {
+    return path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+}
+function launcherDir() {
+    const base = process.platform === 'win32'
+        ? (process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'))
+        : path.join(os.homedir(), '.fullcourtdefense');
+    return path.join(base, 'FullCourtDefense');
+}
+/** On Windows, write a hidden VBS launcher so the scheduled run doesn't flash a console window. */
+function ensureWindowsLauncher() {
+    const dir = launcherDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const vbs = path.join(dir, 'auto-protect.vbs');
+    const node = process.execPath;
+    const cli = cliEntry();
+    // WScript.Shell.Run with window style 0 = hidden, wait = false.
+    const inner = `"${node}" "${cli}" protect-all`;
+    const content = `CreateObject("WScript.Shell").Run "cmd /c ${inner.replace(/"/g, '""')}", 0, False\n`;
+    fs.writeFileSync(vbs, content, 'utf8');
+    return vbs;
+}
+function installWindows(intervalMinutes, onLogon) {
+    const vbs = ensureWindowsLauncher();
+    const tr = `wscript.exe "${vbs}"`;
+    const baseArgs = ['/Create', '/TN', TASK_NAME, '/TR', tr, '/F', '/RL', 'LIMITED'];
+    const schedArgs = onLogon
+        ? ['/SC', 'ONLOGON']
+        : ['/SC', 'MINUTE', '/MO', String(intervalMinutes)];
+    const result = (0, child_process_1.spawnSync)('schtasks', [...baseArgs, ...schedArgs], { stdio: 'inherit' });
+    return result.status === 0;
+}
+function uninstallWindows() {
+    const result = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'inherit' });
+    const vbs = path.join(launcherDir(), 'auto-protect.vbs');
+    try {
+        if (fs.existsSync(vbs))
+            fs.unlinkSync(vbs);
+    }
+    catch { /* ignore */ }
+    return result.status === 0;
+}
+function statusWindows() {
+    (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME, '/V', '/FO', 'LIST'], { stdio: 'inherit' });
+}
+function readCrontab() {
+    const result = (0, child_process_1.spawnSync)('crontab', ['-l'], { encoding: 'utf8' });
+    return result.status === 0 ? (result.stdout || '') : '';
+}
+function writeCrontab(content) {
+    const result = (0, child_process_1.spawnSync)('crontab', ['-'], { input: content.endsWith('\n') ? content : `${content}\n`, encoding: 'utf8' });
+    return result.status === 0;
+}
+function installUnix(intervalMinutes, onLogon) {
+    const node = process.execPath;
+    const cli = cliEntry();
+    const command = `"${node}" "${cli}" protect-all >/dev/null 2>&1`;
+    const schedule = onLogon ? '@reboot' : `*/${Math.max(1, intervalMinutes)} * * * *`;
+    const line = `${schedule} ${command} ${CRON_MARKER}`;
+    const existing = readCrontab().split('\n').filter(l => l && !l.includes(CRON_MARKER));
+    return writeCrontab([...existing, line].join('\n'));
+}
+function uninstallUnix() {
+    const existing = readCrontab().split('\n').filter(l => l && !l.includes(CRON_MARKER));
+    return writeCrontab(existing.join('\n'));
+}
+async function autoProtectCommand(args, config) {
+    const intervalMinutes = Number(args.intervalMinutes) > 0 ? Math.floor(Number(args.intervalMinutes)) : 60;
+    const onLogon = args.onLogon === 'true';
+    if (args.uninstall === 'true') {
+        const ok = process.platform === 'win32' ? uninstallWindows() : uninstallUnix();
+        console.log(ok
+            ? `${COLOR.green}Removed the FullCourtDefense auto-protect schedule.${COLOR.reset}`
+            : `${COLOR.yellow}No auto-protect schedule found (or removal failed).${COLOR.reset}`);
+        return;
+    }
+    if (args.status === 'true') {
+        if (process.platform === 'win32')
+            statusWindows();
+        else
+            console.log(readCrontab().split('\n').filter(l => l.includes(CRON_MARKER)).join('\n') || 'No auto-protect cron entry found.');
+        return;
+    }
+    // Default action is install.
+    console.log(`\n${COLOR.bold}${COLOR.cyan}FullCourtDefense — schedule self-healing auto-protect${COLOR.reset}`);
+    console.log(`${COLOR.gray}Re-runs \`protect-all\` ${onLogon ? 'at every logon' : `every ${intervalMinutes} min`} so any server that loses the proxy is automatically re-wrapped.${COLOR.reset}\n`);
+    // Protect everything once right now, then register the recurring task.
+    await (0, mcpGateway_1.protectAllCommand)({ ...args, install: undefined, uninstall: undefined, status: undefined }, config);
+    const ok = process.platform === 'win32'
+        ? installWindows(intervalMinutes, onLogon)
+        : installUnix(intervalMinutes, onLogon);
+    console.log('');
+    if (ok) {
+        console.log(`${COLOR.green}${COLOR.bold}Auto-protect scheduled.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Trigger:${COLOR.reset} ${onLogon ? 'at logon' : `every ${intervalMinutes} minutes`}`);
+        console.log(`${COLOR.gray}Task:${COLOR.reset} ${process.platform === 'win32' ? `Scheduled Task "${TASK_NAME}"` : 'crontab entry'}`);
+        console.log(`${COLOR.gray}Status:${COLOR.reset} fullcourtdefense auto-protect --status true`);
+        console.log(`${COLOR.gray}Remove:${COLOR.reset} fullcourtdefense auto-protect --uninstall true`);
+    }
+    else {
+        console.log(`${COLOR.red}Could not register the schedule.${COLOR.reset} On Windows you may need to run the terminal as Administrator, or use --on-logon true.`);
+    }
+}

package/dist/commands/mcpGateway.js

@@ -1279,33 +1279,48 @@ async function protectAllCommand(args, config) {
             : 'No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
         return;
     }
+    console.log(`\x1b[2mAuto-searching every known MCP client on this machine — ${files.length} config file(s) found.\x1b[0m\n`);
     let totalWrapped = 0;
     let totalManaged = 0;
     let totalRemote = 0;
+    let totalEmpty = 0;
+    const presentClientKeys = new Set();
     for (const file of files) {
+        presentClientKeys.add(file.clientKey);
         const agentClient = CLIENT_KEY_TO_AGENT[file.clientKey] || 'cursor';
         const isToml = /\.toml$/i.test(file.path);
         const stats = isToml
             ? transformCodexToml(file.path, 'wrap', gatewayConfig, dryRun)
             : wrapJsonConfigFile(file.path, gatewayConfig, agentClient, dryRun);
-        if (!stats)
-            continue;
-        if (stats.wrapped.length === 0 && stats.skippedManaged.length === 0 && stats.skippedRemote.length === 0)
+        console.log(`\x1b[1m${file.source}\x1b[0m  \x1b[2m${file.path}\x1b[0m`);
+        if (!stats) {
+            console.log('  \x1b[33m• could not parse — left unchanged\x1b[0m\n');
             continue;
+        }
+        const found = stats.wrapped.length + stats.skippedManaged.length + stats.skippedRemote.length;
         totalWrapped += stats.wrapped.length;
         totalManaged += stats.skippedManaged.length;
         totalRemote += stats.skippedRemote.length;
-        console.log(`\x1b[1m${file.source}\x1b[0m  \x1b[2m${file.path}\x1b[0m`);
         if (stats.wrapped.length)
-            console.log(`  \x1b[32m✓ wrapped:\x1b[0m ${stats.wrapped.join(', ')}`);
+            console.log(`  \x1b[32m✓ ${dryRun ? 'would update' : 'updated'} → now protected:\x1b[0m ${stats.wrapped.join(', ')}`);
         if (stats.skippedManaged.length)
-            console.log(`  \x1b[2m• already protected:\x1b[0m ${stats.skippedManaged.join(', ')}`);
+            console.log(`  \x1b[2m• already protected (unchanged):\x1b[0m ${stats.skippedManaged.join(', ')}`);
         if (stats.skippedRemote.length)
             console.log(`  \x1b[33m• skipped (remote/no command):\x1b[0m ${stats.skippedRemote.join(', ')}`);
+        if (found === 0) {
+            totalEmpty++;
+            console.log('  \x1b[2m• no MCP servers configured — nothing to protect\x1b[0m');
+        }
         console.log('');
     }
+    // Show leading tools that have NO config file at all, so it's clear they were searched.
+    const consideredClients = exports.ALL_GATEWAY_CLIENTS.filter(c => !allowedClientKeys || (AGENT_TO_CLIENT_KEYS[c] || []).some(k => allowedClientKeys.has(k)));
+    const notConfigured = consideredClients.filter(c => !(AGENT_TO_CLIENT_KEYS[c] || []).some(k => presentClientKeys.has(k)));
+    if (notConfigured.length) {
+        console.log(`\x1b[2mNot configured (no config file found): ${notConfigured.map(c => CLIENT_LABELS[c]).join(', ')}\x1b[0m\n`);
+    }
     console.log('\x1b[1mSummary\x1b[0m');
-    console.log(`  ${dryRun ? 'would wrap' : 'wrapped'}: ${totalWrapped}   already protected: ${totalManaged}   skipped remote: ${totalRemote}`);
+    console.log(`  ${dryRun ? 'would update' : 'updated'}: ${totalWrapped}   already protected: ${totalManaged}   no servers: ${totalEmpty}   skipped remote: ${totalRemote}`);
     console.log(`  Each protected server enforces your org Action Policies (allow / block / wait-for-human-approval) on its tool calls.`);
     if (!dryRun && totalWrapped > 0)
         console.log('  Backups saved next to each edited file (*.fcd-backup-*). Restart each client to load the protected servers.');

package/dist/index.js

@@ -45,6 +45,7 @@ const hook_1 = require("./commands/hook");
 const installCursorHook_1 = require("./commands/installCursorHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
 const installAll_1 = require("./commands/installAll");
+const autoProtect_1 = require("./commands/autoProtect");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -133,6 +134,10 @@ function printHelp() {
     unprotect-all
                 Reverse protect-all: restore every server to its original command.
                 Also supports --clients to target one tool, and --dry-run.
+    auto-protect
+                Self-healing: schedule protect-all to re-run automatically so any
+                server that loses the proxy is re-wrapped. --interval-minutes 60
+                (default) or --on-logon true. --uninstall true / --status true.
     install-mcp-gateway
                 Install MCP gateway into selected clients (--clients all for every tool).
     install-cursor-mcp-gateway
@@ -530,6 +535,21 @@ async function main() {
             await (0, mcpGateway_1.unprotectAllCommand)(args, config);
             break;
         }
+        case 'auto-protect': {
+            const args = {
+                ...buildGatewayArgs(),
+                clients: flags.clients,
+                config: flags.config,
+                dryRun: flags['dry-run'],
+                install: flags.install,
+                uninstall: flags.uninstall,
+                status: flags.status,
+                intervalMinutes: flags['interval-minutes'],
+                onLogon: flags['on-logon'],
+            };
+            await (0, autoProtect_1.autoProtectCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 ...buildGatewayArgs(),

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.5.3"
+  "version": "1.6.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {