fullcourtdefense-cli 1.7.12 → 1.7.14

package/dist/commands/local-scan.js

@@ -1096,7 +1096,7 @@ function compactScanHtml(args) {
     h1 { margin: 6px 0 8px; font-size: 26px; line-height: 1.15; }
     p { color: #475569; line-height: 1.55; }
     .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
-    .menuShell { display: grid; grid-template-columns: minmax(180px, 1fr) minmax(0, 3fr) minmax(160px, .85fr); gap: 14px; margin-top: 18px; align-items: stretch; }
+    .menuShell { display: grid; grid-template-columns: minmax(0, 1.15fr) minmax(0, 1.15fr) minmax(180px, .7fr); gap: 14px; margin-top: 18px; align-items: stretch; }
     .menuGroup { border: 1px solid #dbeafe; background: rgba(255,255,255,.7); border-radius: 20px; padding: 12px; }
     .menuGroup.run { border-color: #bbf7d0; background: #f0fdf4; }
     .menuLabel { color: #475569; font-size: 11px; font-weight: 900; letter-spacing: .08em; text-transform: uppercase; margin: 0 0 9px; }
@@ -1108,6 +1108,12 @@ function compactScanHtml(args) {
     .sectionTitle h2 { margin: 0; font-size: 18px; }
     .muted { color: #64748b; font-size: 13px; }
     .card { cursor: pointer; border: 2px solid #e2e8f0; background: white; border-radius: 18px; padding: 16px; text-align: left; transition: .15s ease; }
+    .workflowCard { min-height: 118px; }
+    .workflowCard b { font-size: 18px; }
+    .workflowCard span { font-size: 13px; }
+    .landingScanGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }
+    .scanTypeGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 12px 0; }
+    .advancedScanGrid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; margin: 8px 0 12px; }
     .card:hover, .card.active { border-color: #2563eb; background: #eff6ff; transform: translateY(-1px); }
     .card b { display: block; font-size: 14px; margin-bottom: 4px; }
     .card span { color: #64748b; font-size: 12px; line-height: 1.35; }
@@ -1157,8 +1163,8 @@ function compactScanHtml(args) {
   <main class="wrap">
     <section class="hero">
       <div class="eyebrow">Local Web Console</div>
-      <h1>Run local MCP tools or scan internal AI targets</h1>
-      <p>This compact browser UI is served by the CLI on 127.0.0.1. One-off MCP tool runs stay local in this page. Red-team scans run locally too, while Shield verdicts and saved reports go outbound to Full Court Defense.</p>
+      <h1>Choose a local workflow</h1>
+      <p>Pick one clear path. Run MCP Tool is a one-off tool call. Security Scan is a red-team scan against an internal endpoint, RAG target, or MCP server.</p>
       <div class="auth">
         <div class="eyebrow">${isConfigured ? 'Authenticated' : 'Authentication Required'}</div>
         <p id="authStatus">${isConfigured
@@ -1189,19 +1195,18 @@ function compactScanHtml(args) {
       <div class="menuShell" id="cards">
         <div class="menuGroup run">
           <div class="menuLabel">Run, not a scan</div>
-          <button class="card active" data-target="runner"><b>Run MCP Tool</b><span>Call one tool through a local MCP server or protected gateway.</span></button>
+          <button class="card workflowCard active" data-workflow="runner"><b>Run one MCP tool</b><span>Call exactly one local MCP tool through a direct server or protected gateway. Best for demos and policy checks.</span></button>
         </div>
         <div class="menuGroup">
           <div class="menuLabel">Security scans</div>
-          <div class="grid">
-            <button class="card" data-target="endpoint"><b>Endpoint Scan</b><span>Red-team an internal agent/chat API.</span></button>
-            <button class="card" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
-            <button class="card" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
+          <div class="landingScanGrid">
+            <button class="card workflowCard" data-workflow="bot"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API.</span></button>
+            <button class="card workflowCard" data-workflow="posture"><b>Security Posture Scan</b><span>Run web-style endpoint security checkup.</span></button>
           </div>
         </div>
         <div class="menuGroup">
           <div class="menuLabel">Help</div>
-          <button class="card" data-target="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
+          <button class="card workflowCard" data-workflow="help"><b>Options</b><span>Modes, formats, and when to use each local workflow.</span></button>
         </div>
       </div>
     </section>
@@ -1265,6 +1270,19 @@ function compactScanHtml(args) {
         </div>
       </div>
 
+      <div id="scan-picker" class="hidden">
+        <div class="note">Security scans run red-team templates locally from this machine. First choose what you want to test.</div>
+        <div class="scanTypeGrid">
+          <button class="card scanTypeCard active" data-target="endpoint"><b>Bot Scan</b><span>Red-team an internal bot, agent, or chat API with prompt-injection templates.</span></button>
+          <button class="card scanTypeCard" data-target="posture"><b>Security Posture Scan</b><span>Run the web-style checkup for HTTPS, headers, auth exposure, and endpoint posture.</span></button>
+        </div>
+        <div class="menuLabel">Advanced local targets</div>
+        <div class="advancedScanGrid">
+          <button class="card scanTypeCard" data-target="rag"><b>RAG Scan</b><span>Test retrieval URL or local corpus path.</span></button>
+          <button class="card scanTypeCard" data-target="mcp"><b>MCP Scan</b><span>Scan tool responses and tool-abuse paths.</span></button>
+        </div>
+      </div>
+
       <div id="endpoint-fields" class="hidden">
         <label>Internal endpoint URL</label>
         <input id="endpoint" placeholder="http://127.0.0.1:3000/chat" />
@@ -1274,6 +1292,30 @@ function compactScanHtml(args) {
         </div>
       </div>
 
+      <div id="posture-fields" class="hidden">
+        <div class="note">Security Posture Scan checks endpoint configuration, auth exposure, headers, transport, and operational security signals. This matches the web Security Checkup flow.</div>
+        <div class="two">
+          <div>
+            <label>AI endpoint URL</label>
+            <input id="postureUrl" placeholder="https://your-ai-endpoint.com/api/chat" />
+          </div>
+          <div>
+            <label>HTTP method</label>
+            <select id="postureMethod"><option value="POST" selected>POST</option><option value="GET">GET</option></select>
+          </div>
+        </div>
+        <div class="two">
+          <div>
+            <label>Auth type</label>
+            <select id="postureAuthType"><option value="none" selected>No Auth</option><option value="bearer">Bearer Token</option><option value="api-key">API Key</option></select>
+          </div>
+          <div>
+            <label>Token / API key value</label>
+            <input id="postureToken" type="password" placeholder="Optional" />
+          </div>
+        </div>
+      </div>
+
       <div id="rag-fields" class="hidden">
         <label>RAG retrieval URL</label>
         <input id="ragUrl" placeholder="http://127.0.0.1:8787/rag/retrieve" />
@@ -1371,27 +1413,31 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
     </section>
   </main>
   <script>
+    const scanTargets = ['endpoint','posture','rag','mcp'];
     let target = 'runner';
     let step = 1;
     const qs = new URLSearchParams(location.search);
-    if (['runner','endpoint','rag','mcp'].includes(qs.get('target'))) target = qs.get('target');
+    if (['runner','endpoint','posture','rag','mcp','help'].includes(qs.get('target'))) target = qs.get('target');
     const byId = id => document.getElementById(id);
+    const workflow = () => target === 'endpoint' ? 'bot' : target === 'posture' ? 'posture' : target;
     const sync = () => {
-      document.querySelectorAll('.card').forEach(c => c.classList.toggle('active', c.dataset.target === target));
-      ['runner','endpoint','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
-      const scanTarget = ['endpoint','rag','mcp'].includes(target);
+      document.querySelectorAll('.workflowCard').forEach(c => c.classList.toggle('active', c.dataset.workflow === workflow()));
+      document.querySelectorAll('.scanTypeCard').forEach(c => c.classList.toggle('active', c.dataset.target === target));
+      ['runner','endpoint','posture','rag','mcp','help'].forEach(id => byId(id + '-fields').classList.toggle('hidden', id !== target));
+      const scanTarget = scanTargets.includes(target);
+      byId('scan-picker').classList.toggle('hidden', !scanTarget);
       byId('scanSteps').classList.toggle('hidden', !scanTarget);
       byId('scanActions').classList.toggle('hidden', !scanTarget);
       byId('connectTitle').textContent = target === 'runner'
         ? 'Run MCP Tool'
         : target === 'help'
           ? 'Local workflow options'
-          : 'Connect scan target';
+          : 'Choose scan target';
       byId('connectSubtitle').textContent = target === 'runner'
         ? 'Call one MCP tool from this machine. This is not a scan.'
         : target === 'help'
           ? 'Choose one-off tool run or local red-team scan.'
-          : 'Choose the internal target to red-team from this machine.';
+          : 'Select Endpoint, RAG, or MCP, then connect the internal target.';
       if (!scanTarget) setStep(1);
     };
     const setStep = next => {
@@ -1402,7 +1448,14 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
         byId('step-dot-' + n).classList.toggle('done', n < step);
       });
     };
-    document.querySelectorAll('.card').forEach(c => c.onclick = () => { target = c.dataset.target; sync(); });
+    document.querySelectorAll('.workflowCard').forEach(c => c.onclick = () => {
+      target = c.dataset.workflow === 'bot' ? 'endpoint' : c.dataset.workflow;
+      sync();
+    });
+    document.querySelectorAll('.scanTypeCard').forEach(c => c.onclick = () => {
+      target = c.dataset.target;
+      sync();
+    });
     sync();
     byId('ragUrl').value = qs.get('ragUrl') || '';
     byId('ragPath').value = qs.get('ragPath') || '';
@@ -1418,6 +1471,7 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
     const payload = () => ({
       target, mode: byId('mode').value, format: byId('format').value,
       endpoint: byId('endpoint').value, inputField: byId('inputField').value, outputField: byId('outputField').value,
+      postureUrl: byId('postureUrl').value, postureMethod: byId('postureMethod').value, postureAuthType: byId('postureAuthType').value, postureToken: byId('postureToken').value,
       ragUrl: byId('ragUrl').value, ragPath: byId('ragPath').value, ragInputField: byId('ragInputField').value, ragOutputField: byId('ragOutputField').value,
       mcpUrl: byId('mcpUrl').value, mcpCommand: byId('mcpCommand').value, mcpArgs: byId('mcpArgs').value, mcpTool: byId('mcpTool').value
     });
@@ -1453,6 +1507,7 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
     const renderCommand = p => {
       const parts = ['fullcourtdefense scan --local --type', p.target, '--mode', p.mode, '--format', p.format, '--no-open'];
       if (p.target === 'endpoint') parts.push('--endpoint', JSON.stringify(p.endpoint), '--method POST --request-format custom --input-field', p.inputField || 'message', '--output-field', p.outputField || 'response');
+      if (p.target === 'posture') return 'Security Posture Scan runs through this local web UI and calls the Full Court Defense posture checkup API for ' + (p.postureUrl || '<endpoint-url>');
       if (p.target === 'rag') { if (p.ragUrl) parts.push('--rag-url', JSON.stringify(p.ragUrl), '--method POST --request-format custom --input-field', p.ragInputField || 'query', '--output-field', p.ragOutputField || 'chunks'); else parts.push('--rag-path', JSON.stringify(p.ragPath || '.\\\\docs')); }
       if (p.target === 'mcp') { if (p.mcpUrl) parts.push('--mcp-url', JSON.stringify(p.mcpUrl)); else parts.push('--mcp-command', p.mcpCommand || 'node', '--mcp-args', JSON.stringify(p.mcpArgs || '.\\\\server.js')); parts.push('--mcp-tool', p.mcpTool || 'all'); }
       return parts.join(' ');
@@ -1508,6 +1563,10 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
       sync();
       setStep(1);
       byId('endpoint').value = '';
+      byId('postureUrl').value = '';
+      byId('postureMethod').value = 'POST';
+      byId('postureAuthType').value = 'none';
+      byId('postureToken').value = '';
       byId('inputField').value = 'message';
       byId('outputField').value = 'response';
       byId('ragUrl').value = '';
@@ -1712,6 +1771,20 @@ Local targets stay on this machine; saved scan reports go to Full Court Defense.
         byId('run').textContent = 'Run local scan';
         return;
       }
+      if (target === 'posture') {
+        try {
+          setConsole('Starting Security Posture Scan...\\n', 'Running posture');
+          const postureRes = await fetch('/posture/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
+          const postureData = await postureRes.json();
+          setConsole(JSON.stringify(postureData, null, 2), postureData.ok ? 'Posture complete' : 'Posture failed');
+        } catch (error) {
+          setConsole('Security Posture Scan failed: ' + (error && error.message ? error.message : String(error)), 'Posture failed');
+        } finally {
+          byId('run').disabled = false;
+          byId('run').textContent = 'Run local scan';
+        }
+        return;
+      }
       setConsole('Starting local red-team scan...\\n', 'Running');
       const res = await fetch('/run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload()) });
       if (!res.body) {
@@ -1824,6 +1897,40 @@ async function runCliFromBrowser(body, onChunk) {
         });
     });
 }
+async function runPostureScanFromBrowser(args, body) {
+    const auth = currentShieldConfig(args);
+    const apiUrl = (auth.apiUrl || DEFAULT_API_URL).replace(/\/$/, '');
+    const endpoint = typeof body.postureUrl === 'string' ? body.postureUrl.trim() : '';
+    const method = body.postureMethod === 'GET' ? 'GET' : 'POST';
+    const authType = typeof body.postureAuthType === 'string' ? body.postureAuthType : 'none';
+    const token = typeof body.postureToken === 'string' ? body.postureToken.trim() : '';
+    if (!endpoint)
+        throw new Error('AI endpoint URL is required for Security Posture Scan.');
+    const headers = {};
+    if (authType === 'bearer' && token)
+        headers.Authorization = `Bearer ${token}`;
+    if (authType === 'api-key' && token)
+        headers['X-API-Key'] = token;
+    const response = await fetch(`${apiUrl}/api/posture/scan/public`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            endpoint,
+            method,
+            scanMode: 'passive',
+            ...(Object.keys(headers).length ? { headers } : {}),
+        }),
+        signal: AbortSignal.timeout(60000),
+    });
+    const text = await response.text();
+    return {
+        ok: response.ok,
+        status: response.status,
+        endpoint,
+        scanType: 'security_posture',
+        result: text,
+    };
+}
 function createMcpClient(options) {
     if (options.transport === 'sse')
         return new SseMcpClient(options);
@@ -1990,6 +2097,13 @@ function startCompactWebServer(args) {
                 res.end(JSON.stringify(result));
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/posture/run') {
+                const body = await readRequestBody(req);
+                const result = await runPostureScanFromBrowser(args, body);
+                res.writeHead(result.ok ? 200 : 400, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify(result));
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/run') {
                 const body = await readRequestBody(req);
                 res.writeHead(200, {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.12"
+  "version": "1.7.14"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.12",
+  "version": "1.7.14",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {