fullcourtdefense-cli 1.7.0 → 1.7.1

package/dist/commands/discover.js

@@ -470,7 +470,7 @@ function sanitizeAgentFileForUpload(finding) {
         excerpt: finding.excerpt,
     };
 }
-async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorName, extras) {
+async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName, extras) {
     const payload = {
         connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
         host,
@@ -505,10 +505,23 @@ async function upload(servers, host, clientCoverage, apiUrl, apiKey, connectorNa
             tools: s.tools,
         })),
     };
-    const resp = await fetch(`${apiUrl.replace(/\/$/, '')}/api/cicd/discovery/mcp`, {
+    // Prefer the org API key path; otherwise fall back to the Shield-key endpoint so
+    // `discover --upload` works straight from `login` credentials with no org key.
+    const base = apiUrl.replace(/\/$/, '');
+    const useShieldKey = !auth.apiKey && !!(auth.shieldId && auth.shieldKey);
+    const url = useShieldKey ? `${base}/api/cli/discovery` : `${base}/api/cicd/discovery/mcp`;
+    const headers = { 'Content-Type': 'application/json' };
+    if (useShieldKey) {
+        headers['x-shield-id'] = auth.shieldId;
+        headers['x-shield-key'] = auth.shieldKey;
+    }
+    else {
+        headers['X-API-Key'] = auth.apiKey;
+    }
+    const resp = await fetch(url, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'X-API-Key': apiKey },
-        body: JSON.stringify(payload),
+        headers,
+        body: JSON.stringify(useShieldKey ? { ...payload, shieldId: auth.shieldId } : payload),
     });
     const data = await resp.json().catch(() => ({}));
     if (!resp.ok || data.success === false) {
@@ -651,18 +664,20 @@ async function discoverCommand(args, config) {
         if (args.upload !== 'true')
             return;
         const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
-        if (!creds.apiKey) {
+        // Either an org API key OR an enrolled Shield key (from `login`) is enough.
+        const hasShieldCreds = !!(creds.shieldId && creds.shieldKey);
+        if (!creds.apiKey && !hasShieldCreds) {
             if (!silent) {
-                console.error(`\n${COLOR.red}--upload requires an API key.${COLOR.reset} Run \`fullcourtdefense setup\` first.`);
+                console.error(`\n${COLOR.red}--upload needs credentials.${COLOR.reset} Run \`fullcourtdefense login --token <fleet-token>\` (or \`fullcourtdefense setup\`) first.`);
             }
             process.exit(1);
         }
-        await upload(found, host, clientCoverage, creds.apiUrl, creds.apiKey, args.connectorName, uploadExtras);
+        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey }, args.connectorName, uploadExtras);
     }
     if (silent) {
         if (args.upload === 'true') {
             const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
-            if (!creds.apiKey)
+            if (!creds.apiKey && !(creds.shieldId && creds.shieldKey))
                 process.exit(1);
             if (!runMcp && !secrets && !agentFiles && !posture)
                 return;

package/dist/commands/installAll.js

@@ -12,12 +12,14 @@ const restartNotice_1 = require("./restartNotice");
  * hooks for built-in Cursor actions, optional self-heal and fleet upload.
  */
 async function installAllCommand(args, config) {
+    // A Shield id/key (from `login` or `setup`) is all that's needed — the org API
+    // key is optional, so the zero-paste `login` → `install-all` flow works without one.
     const creds = (0, config_1.requireCliSetup)(config, {
         apiKey: args.apiKey,
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
         apiUrl: args.apiUrl,
-    }, { requireOrganizationId: false });
+    }, { requireOrganizationId: false, requireApiKey: false });
     const gatewayArgs = {
         ...args,
         ...creds,
@@ -51,7 +53,10 @@ async function installAllCommand(args, config) {
             intervalMinutes: args.intervalMinutes || '60',
         }, config);
     }
-    if (args.discover === 'true' || args.upload === 'true') {
+    // Run discovery + upload by default so the AI Fleet "Devices & MCP" view is
+    // populated on first install — no extra command, no org API key (uploads via
+    // the enrolled Shield key). Opt out with `--discover false`.
+    if (args.discover !== 'false') {
         console.log('\n\x1b[1mUploading desktop posture to AI Fleet…\x1b[0m');
         const discoverArgs = {
             surface: 'all',
@@ -59,7 +64,6 @@ async function installAllCommand(args, config) {
             apiKey: creds.apiKey,
             apiUrl: creds.apiUrl,
             userEmail: args.developerName,
-            silent: args.upload === 'true' && args.discover !== 'true' ? 'true' : undefined,
         };
         await (0, discover_1.discoverCommand)(discoverArgs, config);
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.0"
+  "version": "1.7.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {