fullcourtdefense-cli 1.7.18 → 1.7.20

package/dist/commands/agentCi.d.ts

@@ -3,6 +3,7 @@ export interface AgentCiArgs {
     failOn?: string;
     format?: string;
     upload?: string;
+    requireUpload?: string;
     requireGateway?: string;
     requireApprovalFor?: string;
     extraPath?: string;

package/dist/commands/agentCi.js

@@ -268,6 +268,20 @@ function printSummary(report, failed, failOn) {
     if (report.findings.length > 20)
         console.log(`... and ${report.findings.length - 20} more findings`);
 }
+function buildCiMetadata() {
+    return {
+        provider: process.env.GITHUB_ACTIONS === 'true' ? 'github_actions' : process.env.CI ? 'ci' : undefined,
+        repository: process.env.GITHUB_REPOSITORY,
+        ref: process.env.GITHUB_REF_NAME || process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF,
+        sha: process.env.GITHUB_SHA,
+        runId: process.env.GITHUB_RUN_ID,
+        runUrl: process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID
+            ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
+            : undefined,
+        workflow: process.env.GITHUB_WORKFLOW,
+        job: process.env.GITHUB_JOB,
+    };
+}
 async function agentCiCommand(args, config) {
     const failOn = (['critical', 'high', 'medium', 'low'].includes(String(args.failOn || '').toLowerCase())
         ? String(args.failOn).toLowerCase()
@@ -286,16 +300,45 @@ async function agentCiCommand(args, config) {
     else {
         printSummary(report, failed, failOn);
     }
-    if (args.upload === 'true') {
+    const uploadRequested = args.upload === 'true' || args.requireUpload === 'true';
+    if (uploadRequested) {
         const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
         if (creds.apiKey || (creds.shieldId && creds.shieldKey)) {
-            await (0, discover_1.runDiscoverUpload)({ apiKey: args.apiKey, apiUrl: args.apiUrl, silent: true }, config).catch(error => {
-                if (format === 'summary')
-                    console.error(`Upload skipped: ${error instanceof Error ? error.message : String(error)}`);
-            });
+            try {
+                await (0, discover_1.runDiscoverUpload)({
+                    apiKey: args.apiKey,
+                    apiUrl: args.apiUrl,
+                    silent: true,
+                    connectorName: `Agent CI Gate${process.env.GITHUB_REPOSITORY ? ` · ${process.env.GITHUB_REPOSITORY}` : ''}`,
+                    agentCiGate: {
+                        status: failed ? 'fail' : 'pass',
+                        score: report.score,
+                        failOn,
+                        findings: report.findings,
+                        mcpServers: report.mcpServers.map(server => ({
+                            name: server.name,
+                            source: server.source,
+                            filePath: server.filePath,
+                            direct: server.direct,
+                            protectedGateway: server.protectedGateway,
+                            riskSignals: server.riskSignals,
+                        })),
+                        uploadedAt: new Date().toISOString(),
+                        ci: buildCiMetadata(),
+                    },
+                }, config);
+                console.error('AgentGuard evidence upload: uploaded to AI Fleet / discovery posture inventory.');
+            }
+            catch (error) {
+                console.error(`AgentGuard evidence upload: failed (${error instanceof Error ? error.message : String(error)})`);
+                if (args.requireUpload === 'true')
+                    process.exit(1);
+            }
         }
-        else if (format === 'summary') {
-            console.error('Upload skipped: run fullcourtdefense login first or pass --api-key.');
+        else {
+            console.error('AgentGuard evidence upload: missing credentials. Run fullcourtdefense login or pass FULLCOURTDEFENSE_API_KEY.');
+            if (args.requireUpload === 'true')
+                process.exit(1);
         }
     }
     if (failed)

package/dist/commands/discover.d.ts

@@ -8,6 +8,7 @@ export interface DiscoverArgs {
     json?: string;
     upload?: string;
     connectorName?: string;
+    agentCiGate?: AgentCiGateUpload;
     extraPath?: string;
     deep?: string;
     silent?: string;
@@ -16,6 +17,39 @@ export interface DiscoverArgs {
     unschedule?: string;
     scheduleHour?: string;
 }
+export interface AgentCiGateUpload {
+    status: 'pass' | 'fail';
+    score: number;
+    failOn: string;
+    findings: Array<{
+        id: string;
+        severity: string;
+        category: string;
+        title: string;
+        detail: string;
+        filePath?: string;
+        remediation: string;
+    }>;
+    mcpServers: Array<{
+        name: string;
+        source: string;
+        filePath: string;
+        direct: boolean;
+        protectedGateway: boolean;
+        riskSignals: string[];
+    }>;
+    uploadedAt: string;
+    ci?: {
+        provider?: string;
+        repository?: string;
+        ref?: string;
+        sha?: string;
+        runId?: string;
+        runUrl?: string;
+        workflow?: string;
+        job?: string;
+    };
+}
 export interface DesktopDiscoveryHost {
     machineId: string;
     hostname: string;
@@ -32,4 +66,5 @@ export declare function runDiscoverUpload(args: {
     userEmail?: string;
     silent?: boolean;
     connectorName?: string;
+    agentCiGate?: AgentCiGateUpload;
 }, config: BotGuardConfig): Promise<void>;

package/dist/commands/discover.js

@@ -511,6 +511,11 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
         } : undefined,
         secrets: extras?.secrets?.findings.slice(0, 100).map(sanitizeSecretForUpload),
         agentFiles: extras?.agentFiles?.slice(0, 100).map(sanitizeAgentFileForUpload),
+        agentCiGate: extras?.agentCiGate ? {
+            ...extras.agentCiGate,
+            findings: extras.agentCiGate.findings.slice(0, 100),
+            mcpServers: extras.agentCiGate.mcpServers.slice(0, 100),
+        } : undefined,
         scanScope: extras?.scanScope,
         servers: servers.map(s => ({
             serverName: s.serverName,
@@ -697,6 +702,7 @@ async function discoverCommand(args, config) {
         secrets,
         agentFiles,
         posture,
+        agentCiGate: args.agentCiGate,
         scanScope: {
             surfaces: [...surfaces],
             workingDirectory: cwd,
@@ -807,5 +813,6 @@ async function runDiscoverUpload(args, config) {
         apiUrl: args.apiUrl,
         userEmail: args.userEmail,
         connectorName: args.connectorName,
+        agentCiGate: args.agentCiGate,
     }, config);
 }

package/dist/index.js

@@ -264,6 +264,7 @@ function printHelp() {
     --fail-on <severity>    agent-ci fail threshold: critical, high, medium, low
     --require-gateway       agent-ci requires risky MCP servers to use FCD gateway
     --require-approval-for  agent-ci risky controls list, e.g. payment,delete,shell,secrets
+    --require-upload        agent-ci fails if evidence cannot upload to AgentGuard UI
     --method <GET|POST>     Local endpoint method
     --request-format <fmt>  Local endpoint request format: custom or openai
     --auth-type <type>      none, bearer, basic, api-key
@@ -502,6 +503,7 @@ async function main() {
                 failOn: flags['fail-on'],
                 format: flags.format,
                 upload: flags.upload,
+                requireUpload: flags['require-upload'],
                 requireGateway: flags['require-gateway'],
                 requireApprovalFor: flags['require-approval-for'],
                 extraPath: flags.path,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.18"
+  "version": "1.7.20"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.18",
+  "version": "1.7.20",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {