fullcourtdefense-cli 1.5.3 → 1.6.1

package/dist/commands/autoProtect.d.ts

@@ -0,0 +1,10 @@
+import { BotGuardConfig } from '../config';
+import { ProtectAllArgs } from './mcpGateway';
+export interface AutoProtectArgs extends ProtectAllArgs {
+    install?: string;
+    uninstall?: string;
+    status?: string;
+    intervalMinutes?: string;
+    onLogon?: string;
+}
+export declare function autoProtectCommand(args: AutoProtectArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/autoProtect.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.autoProtectCommand = autoProtectCommand;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const mcpGateway_1 = require("./mcpGateway");
+const COLOR = {
+    reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+    red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
+};
+const TASK_NAME = 'FullCourtDefense Auto-Protect';
+const CRON_MARKER = '# FCD_AUTO_PROTECT';
+function cliEntry() {
+    return path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+}
+function launcherDir() {
+    const base = process.platform === 'win32'
+        ? (process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'))
+        : path.join(os.homedir(), '.fullcourtdefense');
+    return path.join(base, 'FullCourtDefense');
+}
+/** On Windows, write a hidden VBS launcher so the scheduled run doesn't flash a console window. */
+function ensureWindowsLauncher() {
+    const dir = launcherDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const vbs = path.join(dir, 'auto-protect.vbs');
+    const node = process.execPath;
+    const cli = cliEntry();
+    // WScript.Shell.Run with window style 0 = hidden, wait = false.
+    const inner = `"${node}" "${cli}" protect-all`;
+    const content = `CreateObject("WScript.Shell").Run "cmd /c ${inner.replace(/"/g, '""')}", 0, False\n`;
+    fs.writeFileSync(vbs, content, 'utf8');
+    return vbs;
+}
+function installWindows(intervalMinutes, onLogon) {
+    const vbs = ensureWindowsLauncher();
+    const tr = `wscript.exe "${vbs}"`;
+    const baseArgs = ['/Create', '/TN', TASK_NAME, '/TR', tr, '/F', '/RL', 'LIMITED'];
+    const schedArgs = onLogon
+        ? ['/SC', 'ONLOGON']
+        : ['/SC', 'MINUTE', '/MO', String(intervalMinutes)];
+    const result = (0, child_process_1.spawnSync)('schtasks', [...baseArgs, ...schedArgs], { stdio: 'inherit' });
+    return result.status === 0;
+}
+function uninstallWindows() {
+    const result = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'inherit' });
+    const vbs = path.join(launcherDir(), 'auto-protect.vbs');
+    try {
+        if (fs.existsSync(vbs))
+            fs.unlinkSync(vbs);
+    }
+    catch { /* ignore */ }
+    return result.status === 0;
+}
+function statusWindows() {
+    (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME, '/V', '/FO', 'LIST'], { stdio: 'inherit' });
+}
+function readCrontab() {
+    const result = (0, child_process_1.spawnSync)('crontab', ['-l'], { encoding: 'utf8' });
+    return result.status === 0 ? (result.stdout || '') : '';
+}
+function writeCrontab(content) {
+    const result = (0, child_process_1.spawnSync)('crontab', ['-'], { input: content.endsWith('\n') ? content : `${content}\n`, encoding: 'utf8' });
+    return result.status === 0;
+}
+function installUnix(intervalMinutes, onLogon) {
+    const node = process.execPath;
+    const cli = cliEntry();
+    const command = `"${node}" "${cli}" protect-all >/dev/null 2>&1`;
+    const schedule = onLogon ? '@reboot' : `*/${Math.max(1, intervalMinutes)} * * * *`;
+    const line = `${schedule} ${command} ${CRON_MARKER}`;
+    const existing = readCrontab().split('\n').filter(l => l && !l.includes(CRON_MARKER));
+    return writeCrontab([...existing, line].join('\n'));
+}
+function uninstallUnix() {
+    const existing = readCrontab().split('\n').filter(l => l && !l.includes(CRON_MARKER));
+    return writeCrontab(existing.join('\n'));
+}
+async function autoProtectCommand(args, config) {
+    const intervalMinutes = Number(args.intervalMinutes) > 0 ? Math.floor(Number(args.intervalMinutes)) : 60;
+    const onLogon = args.onLogon === 'true';
+    if (args.uninstall === 'true') {
+        const ok = process.platform === 'win32' ? uninstallWindows() : uninstallUnix();
+        console.log(ok
+            ? `${COLOR.green}Removed the FullCourtDefense auto-protect schedule.${COLOR.reset}`
+            : `${COLOR.yellow}No auto-protect schedule found (or removal failed).${COLOR.reset}`);
+        return;
+    }
+    if (args.status === 'true') {
+        if (process.platform === 'win32')
+            statusWindows();
+        else
+            console.log(readCrontab().split('\n').filter(l => l.includes(CRON_MARKER)).join('\n') || 'No auto-protect cron entry found.');
+        return;
+    }
+    // Default action is install.
+    console.log(`\n${COLOR.bold}${COLOR.cyan}FullCourtDefense — schedule self-healing auto-protect${COLOR.reset}`);
+    console.log(`${COLOR.gray}Re-runs \`protect-all\` ${onLogon ? 'at every logon' : `every ${intervalMinutes} min`} so any server that loses the proxy is automatically re-wrapped.${COLOR.reset}\n`);
+    // Protect everything once right now, then register the recurring task.
+    await (0, mcpGateway_1.protectAllCommand)({ ...args, install: undefined, uninstall: undefined, status: undefined }, config);
+    const ok = process.platform === 'win32'
+        ? installWindows(intervalMinutes, onLogon)
+        : installUnix(intervalMinutes, onLogon);
+    console.log('');
+    if (ok) {
+        console.log(`${COLOR.green}${COLOR.bold}Auto-protect scheduled.${COLOR.reset}`);
+        console.log(`${COLOR.gray}Trigger:${COLOR.reset} ${onLogon ? 'at logon' : `every ${intervalMinutes} minutes`}`);
+        console.log(`${COLOR.gray}Task:${COLOR.reset} ${process.platform === 'win32' ? `Scheduled Task "${TASK_NAME}"` : 'crontab entry'}`);
+        console.log(`${COLOR.gray}Status:${COLOR.reset} fullcourtdefense auto-protect --status true`);
+        console.log(`${COLOR.gray}Remove:${COLOR.reset} fullcourtdefense auto-protect --uninstall true`);
+    }
+    else {
+        console.log(`${COLOR.red}Could not register the schedule.${COLOR.reset} On Windows you may need to run the terminal as Administrator, or use --on-logon true.`);
+    }
+}

package/dist/commands/installAll.d.ts

@@ -1,12 +1,16 @@
 import { BotGuardConfig } from '../config';
-import { InstallMcpGatewayArgs } from './mcpGateway';
-export interface InstallAllArgs extends InstallMcpGatewayArgs {
+import { ProtectAllArgs } from './mcpGateway';
+export interface InstallAllArgs extends ProtectAllArgs {
+    apiKey?: string;
+    cursorProject?: string;
+    upload?: string;
     hooks?: string;
     discover?: string;
+    autoProtect?: string;
+    intervalMinutes?: string;
 }
 /**
- * One-click install: MCP gateway into every supported AI client, optional
- * Cursor hooks, optional fleet upload. Hooks are opt-in because Action Policies
- * should be the default enforcement path for MCP tools.
+ * One-click install: discover/wrap every existing MCP server, install Cursor
+ * hooks for built-in Cursor actions, optional self-heal and fleet upload.
  */
 export declare function installAllCommand(args: InstallAllArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/installAll.js

@@ -5,10 +5,10 @@ const config_1 = require("../config");
 const discover_1 = require("./discover");
 const installCursorHook_1 = require("./installCursorHook");
 const mcpGateway_1 = require("./mcpGateway");
+const autoProtect_1 = require("./autoProtect");
 /**
- * One-click install: MCP gateway into every supported AI client, optional
- * Cursor hooks, optional fleet upload. Hooks are opt-in because Action Policies
- * should be the default enforcement path for MCP tools.
+ * One-click install: discover/wrap every existing MCP server, install Cursor
+ * hooks for built-in Cursor actions, optional self-heal and fleet upload.
  */
 async function installAllCommand(args, config) {
     const creds = (0, config_1.requireCliSetup)(config, {
@@ -23,15 +23,17 @@ async function installAllCommand(args, config) {
         clients: args.clients || 'all',
     };
     console.log('\n\x1b[1m\x1b[36mFullCourtDefense — install all AI clients\x1b[0m');
-    console.log('\x1b[2mMCP gateway + optional fleet upload. Cursor hooks are opt-in with --hooks true.\x1b[0m\n');
-    await (0, mcpGateway_1.installMcpGatewayCommand)(gatewayArgs, config);
-    if (args.hooks === 'true') {
+    console.log('\x1b[2mAuto-protect existing MCP servers + Cursor action hooks. No --mcp-command or folder path needed.\x1b[0m\n');
+    await (0, mcpGateway_1.protectAllCommand)(gatewayArgs, config);
+    if (args.hooks !== 'false') {
         console.log('\n\x1b[1mInstalling Cursor runtime hooks…\x1b[0m');
         const hookArgs = {
             shieldId: creds.shieldId,
             shieldKey: creds.shieldKey,
             apiUrl: creds.apiUrl,
             project: args.cursorProject,
+            events: 'prompt,shell,mcp,file,read',
+            failClosed: 'true',
         };
         try {
             await (0, installCursorHook_1.installCursorHookCommand)(hookArgs, config);
@@ -40,6 +42,13 @@ async function installAllCommand(args, config) {
             console.log(`Cursor hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    if (args.autoProtect === 'true') {
+        console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
+        await (0, autoProtect_1.autoProtectCommand)({
+            ...gatewayArgs,
+            intervalMinutes: args.intervalMinutes || '60',
+        }, config);
+    }
     if (args.discover === 'true' || args.upload === 'true') {
         console.log('\n\x1b[1mUploading desktop posture to AI Fleet…\x1b[0m');
         const discoverArgs = {
@@ -52,5 +61,5 @@ async function installAllCommand(args, config) {
         };
         await (0, discover_1.discoverCommand)(discoverArgs, config);
     }
-    console.log('\n\x1b[32mDone.\x1b[0m Restart each AI client you use, then run \x1b[1mfullcourtdefense discover --surface mcp\x1b[0m to verify gateways.');
+    console.log('\n\x1b[32mDone.\x1b[0m Restart each AI client you use, then run \x1b[1mfullcourtdefense protect-all --dry-run true\x1b[0m to verify gateways.');
 }

package/dist/commands/installCursorHook.js

@@ -109,8 +109,8 @@ async function installCursorHookCommand(args, config) {
     const projectScope = args.project === 'true';
     const shadow = args.shadow === 'true';
     const file = hooksJsonPath(projectScope);
-    const requested = (args.events || 'prompt,shell,mcp')
-        .split(',').map((e) => e.trim().toLowerCase()).filter(Boolean);
+    const requested = (args.events || 'prompt,shell,mcp,file,read')
+        .split(/[\s,]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
     const events = requested.filter((e) => EVENT_MAP[e]);
     if (events.length === 0) {
         console.error(`${COLOR.red}No valid events. Choose from: ${Object.keys(EVENT_MAP).join(', ')}${COLOR.reset}`);

package/dist/commands/mcpGateway.js

@@ -1279,33 +1279,48 @@ async function protectAllCommand(args, config) {
             : 'No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
         return;
     }
+    console.log(`\x1b[2mAuto-searching every known MCP client on this machine — ${files.length} config file(s) found.\x1b[0m\n`);
     let totalWrapped = 0;
     let totalManaged = 0;
     let totalRemote = 0;
+    let totalEmpty = 0;
+    const presentClientKeys = new Set();
     for (const file of files) {
+        presentClientKeys.add(file.clientKey);
         const agentClient = CLIENT_KEY_TO_AGENT[file.clientKey] || 'cursor';
         const isToml = /\.toml$/i.test(file.path);
         const stats = isToml
             ? transformCodexToml(file.path, 'wrap', gatewayConfig, dryRun)
             : wrapJsonConfigFile(file.path, gatewayConfig, agentClient, dryRun);
-        if (!stats)
-            continue;
-        if (stats.wrapped.length === 0 && stats.skippedManaged.length === 0 && stats.skippedRemote.length === 0)
+        console.log(`\x1b[1m${file.source}\x1b[0m  \x1b[2m${file.path}\x1b[0m`);
+        if (!stats) {
+            console.log('  \x1b[33m• could not parse — left unchanged\x1b[0m\n');
             continue;
+        }
+        const found = stats.wrapped.length + stats.skippedManaged.length + stats.skippedRemote.length;
         totalWrapped += stats.wrapped.length;
         totalManaged += stats.skippedManaged.length;
         totalRemote += stats.skippedRemote.length;
-        console.log(`\x1b[1m${file.source}\x1b[0m  \x1b[2m${file.path}\x1b[0m`);
         if (stats.wrapped.length)
-            console.log(`  \x1b[32m✓ wrapped:\x1b[0m ${stats.wrapped.join(', ')}`);
+            console.log(`  \x1b[32m✓ ${dryRun ? 'would update' : 'updated'} → now protected:\x1b[0m ${stats.wrapped.join(', ')}`);
         if (stats.skippedManaged.length)
-            console.log(`  \x1b[2m• already protected:\x1b[0m ${stats.skippedManaged.join(', ')}`);
+            console.log(`  \x1b[2m• already protected (unchanged):\x1b[0m ${stats.skippedManaged.join(', ')}`);
         if (stats.skippedRemote.length)
             console.log(`  \x1b[33m• skipped (remote/no command):\x1b[0m ${stats.skippedRemote.join(', ')}`);
+        if (found === 0) {
+            totalEmpty++;
+            console.log('  \x1b[2m• no MCP servers configured — nothing to protect\x1b[0m');
+        }
         console.log('');
     }
+    // Show leading tools that have NO config file at all, so it's clear they were searched.
+    const consideredClients = exports.ALL_GATEWAY_CLIENTS.filter(c => !allowedClientKeys || (AGENT_TO_CLIENT_KEYS[c] || []).some(k => allowedClientKeys.has(k)));
+    const notConfigured = consideredClients.filter(c => !(AGENT_TO_CLIENT_KEYS[c] || []).some(k => presentClientKeys.has(k)));
+    if (notConfigured.length) {
+        console.log(`\x1b[2mNot configured (no config file found): ${notConfigured.map(c => CLIENT_LABELS[c]).join(', ')}\x1b[0m\n`);
+    }
     console.log('\x1b[1mSummary\x1b[0m');
-    console.log(`  ${dryRun ? 'would wrap' : 'wrapped'}: ${totalWrapped}   already protected: ${totalManaged}   skipped remote: ${totalRemote}`);
+    console.log(`  ${dryRun ? 'would update' : 'updated'}: ${totalWrapped}   already protected: ${totalManaged}   no servers: ${totalEmpty}   skipped remote: ${totalRemote}`);
     console.log(`  Each protected server enforces your org Action Policies (allow / block / wait-for-human-approval) on its tool calls.`);
     if (!dryRun && totalWrapped > 0)
         console.log('  Backups saved next to each edited file (*.fcd-backup-*). Restart each client to load the protected servers.');

package/dist/index.js

@@ -45,6 +45,7 @@ const hook_1 = require("./commands/hook");
 const installCursorHook_1 = require("./commands/installCursorHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
 const installAll_1 = require("./commands/installAll");
+const autoProtect_1 = require("./commands/autoProtect");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -112,7 +113,9 @@ function printHelp() {
     configure   Saves org API key, Organization ID, Shield ID, and Shield key to ~/.fullcourtdefense.yml.
                 After setup, other commands read credentials automatically — no --shield-id/--api-key needed.
     setup       Same as configure — validates credentials against the server before saving.
-    install-all One-click: MCP gateway in every AI client. Cursor hooks are opt-in.
+    install-all One-click: protect existing MCP servers in every AI client and
+                install Cursor hooks for built-in Cursor actions. No folder path
+                or --mcp-command needed. Use --hooks false to skip Cursor hooks.
     install     Alias for install-all.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
@@ -133,6 +136,10 @@ function printHelp() {
     unprotect-all
                 Reverse protect-all: restore every server to its original command.
                 Also supports --clients to target one tool, and --dry-run.
+    auto-protect
+                Self-healing: schedule protect-all to re-run automatically so any
+                server that loses the proxy is re-wrapped. --interval-minutes 60
+                (default) or --on-logon true. --uninstall true / --status true.
     install-mcp-gateway
                 Install MCP gateway into selected clients (--clients all for every tool).
     install-cursor-mcp-gateway
@@ -169,8 +176,8 @@ function printHelp() {
        fullcourtdefense setup
        Saves to ~/.fullcourtdefense.yml — install, discover --upload, scan, gateway, and hooks use it automatically.
 
-    4. One-click protect every AI client on this machine with MCP Action Policies:
-       fullcourtdefense install-all --mcp-command npm --mcp-args "run mcp"
+    4. One-click protect every AI client on this machine with Action Policies:
+       fullcourtdefense install-all
        Verify installs:
        fullcourtdefense discover --surface mcp
        Or install one client: fullcourtdefense install-cursor-mcp-gateway ...
@@ -290,8 +297,8 @@ function printHelp() {
     $ fullcourtdefense install-claude-desktop-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense setup
-    $ fullcourtdefense install-all --mcp-command npm --mcp-args "run mcp"
-    $ fullcourtdefense install-all --mcp-command npm --mcp-args "run mcp" --upload
+    $ fullcourtdefense install-all
+    $ fullcourtdefense install-all --auto-protect true --upload
     $ fullcourtdefense install-mcp-gateway --clients cursor,codex --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-codex-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense scan --system-prompt ./prompts/system.md --fail-threshold 80
@@ -500,6 +507,8 @@ async function main() {
                 ...buildInstallArgs(),
                 hooks: flags.hooks,
                 discover: flags.discover,
+                autoProtect: flags['auto-protect'],
+                intervalMinutes: flags['interval-minutes'],
             };
             await (0, installAll_1.installAllCommand)(args, config);
             break;
@@ -530,6 +539,21 @@ async function main() {
             await (0, mcpGateway_1.unprotectAllCommand)(args, config);
             break;
         }
+        case 'auto-protect': {
+            const args = {
+                ...buildGatewayArgs(),
+                clients: flags.clients,
+                config: flags.config,
+                dryRun: flags['dry-run'],
+                install: flags.install,
+                uninstall: flags.uninstall,
+                status: flags.status,
+                intervalMinutes: flags['interval-minutes'],
+                onLogon: flags['on-logon'],
+            };
+            await (0, autoProtect_1.autoProtectCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 ...buildGatewayArgs(),

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.5.3"
+  "version": "1.6.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.5.3",
+  "version": "1.6.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {