fullcourtdefense-cli 1.7.11 → 1.7.13

package/dist/commands/local-scan.js

@@ -1096,7 +1096,7 @@ function compactScanHtml(args) {
     h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
     p { color: #475569; line-height: 1.55; }
     .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
-    .menuShell { display: grid; grid-template-columns: minmax(180px, 1fr) minmax(0, 3fr) minmax(160px, .85fr); gap: 14px; margin-top: 18px; align-items: stretch; }
+    .menuShell { display: grid; grid-template-columns: minmax(0, 1.15fr) minmax(0, 1.15fr) minmax(180px, .7fr); gap: 14px; margin-top: 18px; align-items: stretch; }
     .menuGroup { border: 1px solid #dbeafe; background: rgba(255,255,255,.7); border-radius: 20px; padding: 12px; }
     .menuGroup.run { border-color: #bbf7d0; background: #f0fdf4; }
     .menuLabel { color: #475569; font-size: 11px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; margin: 0 0 9px; }
@@ -1108,6 +1108,11 @@ function compactScanHtml(args) {
     .sectionTitle h2 { margin: 0; font-size: 18px; }
     .muted { color: #64748b; font-size: 13px; }
     .card { cursor: pointer; border: 2px solid #e2e8f0; background: white; border-radius: 18px; padding: 16px; text-align: left; transition: .15s ease; }
+    .workflowCard { min-height: 118px; }
+    .workflowCard b { font-size: 18px; }
+    .workflowCard span { font-size: 13px; }
+    .scanTypeGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 12px 0; }
+    .advancedScanGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 8px 0 12px; }
     .card:hover, .card.active { border-color: #2563eb; background: #eff6ff; transform: translateY(-1px); }
     .card b { display: block; font-size: 14px; margin-bottom: 4px; }
     .card span { color: #64748b; font-size: 12px; line-height: 1.35; }
@@ -1157,8 +1162,8 @@ function compactScanHtml(args) {
   <main class="wrap">
     <section class="hero">
       <div class="eyebrow">Local Web Console</div>
-      <h1>Run local MCP tools or scan internal AI targets</h1>
-      <p>This compact browser UI is served by the CLI on 127.0.0.1. One-off MCP tool runs stay local in this page. Red-team scans run locally too, while Shield verdicts and saved reports go outbound to Full Court Defense.</p>
+      <h1>Choose a local workflow</h1>
+      <p>Pick one clear path. Run MCP Tool is a one-off tool call. Security Scan is a red-team scan against an internal endpoint, RAG target, or MCP server.</p>
       <div class="auth">
         <div class="eyebrow">${isConfigured ? 'Authenticated' : 'Authentication Required'}</div>
         <p id="authStatus">${isConfigured
@@ -1181,7 +1186,7 @@ function compactScanHtml(args) {
         </div>
         <div class="note" id="backendStatus">Backend status: not checked yet.</div>
       </div>
-      <div class="steps">
+      <div class="steps" id="scanSteps">
         <div class="step active" id="step-dot-1">1. Connect target</div>
         <div class="step" id="step-dot-2">2. Select scan type</div>
         <div class="step" id="step-dot-3">3. Run red-team scan</div>
@@ -1189,19 +1194,15 @@ function compactScanHtml(args) {
       <div class="menuShell" id="cards">
         <div class="menuGroup run">
           <div class="menuLabel">Run, not a scan</div>
-          <button class="card active" data-target="runner"><b>Run MCP Tool</b><span>Call one tool through a local MCP server or protected gateway.</span></button>
+          <button class="card workflowCard active" data-workflow="runner"><b>Run one MCP tool</b><span>Call exactly one local MCP tool through a direct server or protected gateway. Best for demos and policy checks.</span></button>
         </div>
         <div class="menuGroup">
           <div class="menuLabel">Security scans</div>
-          <div class="grid">
-            <button class="card" data-target="endpoint"><b>Endpoint Scan</b><span>Red-team an internal agent/chat API.</span></button>
-            <button class="card" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
-            <button class="card" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
-          </div>
+          <button class="card workflowCard" data-workflow="scan"><b>Start security scan</b><span>Run quick or full red-team tests against Endpoint, RAG, or MCP targets. Reports save to Full Court Defense.</span></button>
         </div>
         <div class="menuGroup">
           <div class="menuLabel">Help</div>
-          <button class="card" data-target="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
+          <button class="card workflowCard" data-workflow="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
         </div>
       </div>
     </section>
@@ -1210,8 +1211,8 @@ function compactScanHtml(args) {
       <div id="step-1" class="stepSection">
       <div class="sectionTitle">
         <div>
-          <h2>Connect target</h2>
-          <div class="muted">Choose Run MCP Tool for a single action, or choose a scan target for red-team testing.</div>
+          <h2 id="connectTitle">Run MCP Tool</h2>
+          <div class="muted" id="connectSubtitle">Call one MCP tool from this machine. This is not a scan.</div>
         </div>
       </div>
       <div id="runner-fields">
@@ -1223,11 +1224,11 @@ function compactScanHtml(args) {
         <div class="two">
           <div>
             <label>Protected MCP HTTP/SSE URL</label>
-            <input id="runnerMcpUrl" placeholder="http://127.0.0.1:5066/mcp" />
+            <input id="runnerMcpUrl" placeholder="Optional: http://127.0.0.1:5066/mcp" />
           </div>
           <div>
             <label>Tool name</label>
-            <input id="runnerTool" placeholder="lookup_customer" />
+            <input id="runnerTool" placeholder="Example: lookup_customer_profile" />
           </div>
         </div>
         <div class="two">
@@ -1241,12 +1242,12 @@ function compactScanHtml(args) {
           </div>
         </div>
         <div class="two">
-          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="fullcourtdefense" /></div>
-          <div><label>Command args</label><input id="runnerMcpArgs" placeholder='mcp-gateway --mcp-command node --mcp-args "[&quot;./server.js&quot;]"' /></div>
+          <div><label>Or stdio command</label><input id="runnerMcpCommand" placeholder="node" /></div>
+          <div><label>Command args</label><input id="runnerMcpArgs" placeholder="C:\\path\\to\\mcp-server.js" /></div>
         </div>
         <label>Tool arguments JSON</label>
         <textarea id="runnerToolArgs" spellcheck="false">{
-  "customerId": "cus_123"
+  "customerId": "RO-PB-10492"
 }</textarea>
         <div class="actions">
           <button class="primary" id="runMcpTool">Run MCP tool</button>
@@ -1265,6 +1266,19 @@ function compactScanHtml(args) {
         </div>
       </div>
 
+      <div id="scan-picker" class="hidden">
+        <div class="note">Security scans run red-team templates locally from this machine. First choose what you want to test.</div>
+        <div class="scanTypeGrid">
+          <button class="card scanTypeCard active" data-target="endpoint"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API with prompt-injection templates.</span></button>
+          <button class="card scanTypeCard" data-target="posture"><b>Security Posture Scan</b><span>Run the web-style checkup for HTTPS, headers, auth exposure, and endpoint posture.</span></button>
+        </div>
+        <div class="menuLabel">Advanced local targets</div>
+        <div class="advancedScanGrid">
+          <button class="card scanTypeCard" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
+          <button class="card scanTypeCard" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
+        </div>
+      </div>
+
       <div id="endpoint-fields" class="hidden">
         <label>Internal endpoint URL</label>
         <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
@@ -1274,6 +1288,30 @@ function compactScanHtml(args) {
         </div>
       </div>
 
+      <div id="posture-fields" class="hidden">
+        <div class="note">Security Posture Scan checks endpoint configuration, auth exposure, headers, transport, and operational security signals. This matches the web Security Checkup flow.</div>
+        <div class="two">
+          <div>
+            <label>AI endpoint URL</label>
+            <input id="postureUrl" placeholder="https://your-ai-endpoint.com/api/chat" />
+          </div>
+          <div>
+            <label>HTTP method</label>
+            <select id="postureMethod"><option value="POST" selected>POST</option><option value="GET">GET</option></select>
+          </div>
+        </div>
+        <div class="two">
+          <div>
+            <label>Auth type</label>
+            <select id="postureAuthType"><option value="none" selected>No Auth</option><option value="bearer">Bearer Token</option><option value="api-key">API Key</option></select>
+          </div>
+          <div>
+            <label>Token / API key value</label>
+            <input id="postureToken" type="password" placeholder="Optional" />
+          </div>
+        </div>
+      </div>
+
       <div id="rag-fields" class="hidden">
         <label>RAG retrieval URL</label>
         <input id="ragUrl" placeholder="http://127.0.0.1:8787/rag/retrieve" />
@@ -1361,25 +1399,42 @@ function compactScanHtml(args) {
           <b>Red-team console</b>
           <span class="pill" id="consoleStatus">Ready</span>
         </div>
-        <pre id="out">Full Court Defense Local Runner ready.
+        <pre id="out">Full Court Defense Local Web Console ready.
 
-Select Endpoint, RAG, or MCP above, then run a scan.
-Quick uses the same critical/high attack selection as the web scanner.
-Full uses the full web attack corpus bundled with the CLI.</pre>
+Choose Run MCP Tool for one live tool call.
+Choose Endpoint/RAG/MCP Scan for a local red-team scan.
+Local targets stay on this machine; saved scan reports go to Full Court Defense.</pre>
       </div>
       </div>
     </section>
   </main>
   <script>
+    const scanTargets = ['endpoint','posture','rag','mcp'];
     let target = 'runner';
     let step = 1;
     const qs = new URLSearchParams(location.search);
-    if (['runner','endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
+    if (['runner','endpoint','posture','rag','mcp','help'].includes(qs.get('target'))) target = qs.get('target');
     const byId = id => document.getElementById(id);
+    const workflow = () => scanTargets.includes(target) ? 'scan' : target;
     const sync = () => {
-      document.querySelectorAll('.card').forEach(c => c.classList.toggle('active', c.dataset.target === target));
-      ['runner','endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
-      byId('scanActions').classList.toggle('hidden', target === 'runner');
+      document.querySelectorAll('.workflowCard').forEach(c => c.classList.toggle('active', c.dataset.workflow === workflow()));
+      document.querySelectorAll('.scanTypeCard').forEach(c => c.classList.toggle('active', c.dataset.target === target));
+      ['runner','endpoint','posture','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      const scanTarget = scanTargets.includes(target);
+      byId('scan-picker').classList.toggle('hidden', !scanTarget);
+      byId('scanSteps').classList.toggle('hidden', !scanTarget);
+      byId('scanActions').classList.toggle('hidden', !scanTarget);
+      byId('connectTitle').textContent = target === 'runner'
+        ? 'Run MCP Tool'
+        : target === 'help'
+          ? 'Local workflow options'
+          : 'Choose scan target';
+      byId('connectSubtitle').textContent = target === 'runner'
+        ? 'Call one MCP tool from this machine. This is not a scan.'
+        : target === 'help'
+          ? 'Choose one-off tool run or local red-team scan.'
+          : 'Select Endpoint, RAG, or MCP, then connect the internal target.';
+      if (!scanTarget) setStep(1);
     };
     const setStep = next => {
       step = next;
@@ -1389,7 +1444,14 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
         byId('step-dot-' + n).classList.toggle('done', n < step);
       });
     };
-    document.querySelectorAll('.card').forEach(c => c.onclick = () => { target = c.dataset.target; sync(); });
+    document.querySelectorAll('.workflowCard').forEach(c => c.onclick = () => {
+      target = c.dataset.workflow === 'scan' ? 'endpoint' : c.dataset.workflow;
+      sync();
+    });
+    document.querySelectorAll('.scanTypeCard').forEach(c => c.onclick = () => {
+      target = c.dataset.target;
+      sync();
+    });
     sync();
     byId('ragUrl').value = qs.get('ragUrl') || '';
     byId('ragPath').value = qs.get('ragPath') || '';
@@ -1398,13 +1460,14 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     byId('mcpCommand').value = qs.get('mcpCommand') || '';
     byId('mcpArgs').value = qs.get('mcpArgs') || '';
     byId('runnerMcpUrl').value = qs.get('mcpUrl') || '';
-    byId('runnerMcpCommand').value = qs.get('mcpCommand') || 'fullcourtdefense';
+    byId('runnerMcpCommand').value = qs.get('mcpCommand') || '';
     byId('runnerMcpArgs').value = qs.get('mcpArgs') || '';
     byId('runnerTool').value = qs.get('mcpTool') || '';
     byId('runnerOperation').value = qs.get('operation') || '';
     const payload = () => ({
       target, mode: byId('mode').value, format: byId('format').value,
       endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
+      postureUrl: byId('postureUrl').value, postureMethod: byId('postureMethod').value, postureAuthType: byId('postureAuthType').value, postureToken: byId('postureToken').value,
       ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
       mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
     });
@@ -1440,6 +1503,7 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
     const renderCommand = p => {
       const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
       if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
+      if (p.target === 'posture') return 'Security Posture Scan runs through this local web UI and calls the Full Court Defense posture checkup API for ' + (p.postureUrl || '<endpoint-url>');
       if (p.target === 'rag') { if (p.ragUrl) parts.push('--rag-url', JSON.stringify(p.ragUrl), '--method POST --request-format custom --input-field', p.ragInputField || 'query', '--output-field', p.ragOutputField || 'chunks'); else parts.push('--rag-path', JSON.stringify(p.ragPath || '.\\\\docs')); }
       if (p.target === 'mcp') { if (p.mcpUrl) parts.push('--mcp-url', JSON.stringify(p.mcpUrl)); else parts.push('--mcp-command', p.mcpCommand || 'node', '--mcp-args', JSON.stringify(p.mcpArgs || '.\\\\server.js')); parts.push('--mcp-tool', p.mcpTool || 'all'); }
       return parts.join(' ');
@@ -1495,6 +1559,10 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
       sync();
       setStep(1);
       byId('endpoint').value = '';
+      byId('postureUrl').value = '';
+      byId('postureMethod').value = 'POST';
+      byId('postureAuthType').value = 'none';
+      byId('postureToken').value = '';
       byId('inputField').value = 'message';
       byId('outputField').value = 'response';
       byId('ragUrl').value = '';
@@ -1506,18 +1574,18 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
       byId('mcpArgs').value = '';
       byId('mcpTool').value = 'all';
       byId('runnerMcpUrl').value = '';
-      byId('runnerMcpCommand').value = 'fullcourtdefense';
+      byId('runnerMcpCommand').value = '';
       byId('runnerMcpArgs').value = '';
       byId('runnerTool').value = '';
       byId('runnerOperation').value = '';
-      byId('runnerToolArgs').value = '{\\n  "customerId": "cus_123"\\n}';
+      byId('runnerToolArgs').value = '{\\n  "customerId": "RO-PB-10492"\\n}';
       byId('mcpResultCard').classList.add('hidden');
       byId('mcpResultJson').value = '';
       byId('mcpResultTable').innerHTML = '';
       byId('mode').value = 'quick';
       byId('format').value = 'report';
       clearScanSummary();
-      setConsole('Full Court Defense Local Runner ready.\\n\\nSelect Endpoint, RAG, or MCP above, then run a scan.\\nQuick uses the same critical/high attack selection as the web scanner.\\nFull uses the full web attack corpus bundled with the CLI.', 'Ready');
+      setConsole('Full Court Defense Local Web Console ready.\\n\\nChoose Run MCP Tool for one live tool call.\\nChoose Endpoint/RAG/MCP Scan for a local red-team scan.', 'Ready');
     };
     byId('command').onclick = () => { setConsole(renderCommand(payload()), 'Command'); };
     byId('connectNext').onclick = () => setStep(2);
@@ -1699,6 +1767,20 @@ Full uses the full web attack corpus bundled with the CLI.</pre>
         byId('run').textContent = 'Run local scan';
         return;
       }
+      if (target === 'posture') {
+        try {
+          setConsole('Starting Security Posture Scan...\\n', 'Running posture');
+          const postureRes = await fetch('/posture/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
+          const postureData = await postureRes.json();
+          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'Posture complete' : 'Posture failed');
+        } catch (error) {
+          setConsole('Security Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'Posture failed');
+        } finally {
+          byId('run').disabled = false;
+          byId('run').textContent = 'Run local scan';
+        }
+        return;
+      }
       setConsole('Starting local red-team scan...\\n', 'Running');
       const res = await fetch('/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
       if (!res.body) {
@@ -1811,6 +1893,40 @@ async function runCliFromBrowser(body, onChunk) {
         });
     });
 }
+async function runPostureScanFromBrowser(args, body) {
+    const auth = currentShieldConfig(args);
+    const apiUrl = (auth.apiUrl || DEFAULT_API_URL).replace(/\/$/, '');
+    const endpoint = typeof body.postureUrl === 'string' ? body.postureUrl.trim() : '';
+    const method = body.postureMethod === 'GET' ? 'GET' : 'POST';
+    const authType = typeof body.postureAuthType === 'string' ? body.postureAuthType : 'none';
+    const token = typeof body.postureToken === 'string' ? body.postureToken.trim() : '';
+    if (!endpoint)
+        throw new Error('AI endpoint URL is required for Security Posture Scan.');
+    const headers = {};
+    if (authType === 'bearer' && token)
+        headers.Authorization = `Bearer ${token}`;
+    if (authType === 'api-key' && token)
+        headers['X-API-Key'] = token;
+    const response = await fetch(`${apiUrl}/api/posture/scan/public`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            endpoint,
+            method,
+            scanMode: 'passive',
+            ...(Object.keys(headers).length ? { headers } : {}),
+        }),
+        signal: AbortSignal.timeout(60000),
+    });
+    const text = await response.text();
+    return {
+        ok: response.ok,
+        status: response.status,
+        endpoint,
+        scanType: 'security_posture',
+        result: text,
+    };
+}
 function createMcpClient(options) {
     if (options.transport === 'sse')
         return new SseMcpClient(options);
@@ -1977,6 +2093,13 @@ function startCompactWebServer(args) {
                 res.end(JSON.stringify(result));
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/posture/run') {
+                const body = await readRequestBody(req);
+                const result = await runPostureScanFromBrowser(args, body);
+                res.writeHead(result.ok ? 200 : 400, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify(result));
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/run') {
                 const body = await readRequestBody(req);
                 res.writeHead(200, {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.11"
+  "version": "1.7.13"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.11",
+  "version": "1.7.13",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {