fullcourtdefense-cli 1.7.2 → 1.7.3

package/dist/commands/discover.js

@@ -64,6 +64,30 @@ function parseSurfaces(args) {
 }
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
+const SECRET_ARG_NAME = /^(?:--?(?:shield-key|api-key|token|mcp-token|mcp-api-key|key|secret|password|credential)|(?:.*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL).*))$/i;
+function redactCommandArgs(args) {
+    const out = [];
+    let redactNext = false;
+    for (const arg of args || []) {
+        if (redactNext) {
+            out.push('[redacted]');
+            redactNext = false;
+            continue;
+        }
+        const eq = arg.indexOf('=');
+        if (eq > 0 && SECRET_ARG_NAME.test(arg.slice(0, eq))) {
+            out.push(`${arg.slice(0, eq + 1)}[redacted]`);
+            continue;
+        }
+        if (SECRET_ARG_NAME.test(arg)) {
+            out.push(arg);
+            redactNext = true;
+            continue;
+        }
+        out.push(arg.replace(SECRET_VALUE, '[redacted]'));
+    }
+    return out;
+}
 function machineFingerprint() {
     const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
     return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
@@ -505,10 +529,11 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
             tools: s.tools,
         })),
     };
-    // Prefer the org API key path; otherwise fall back to the Shield-key endpoint so
-    // `discover --upload` works straight from `login` credentials with no org key.
+    // Prefer the enrolled Shield-key endpoint when available so the zero-paste
+    // `login --token` flow works even if an older org API key remains in config.
+    // Passing --api-key is the explicit opt-in to the org API key path.
     const base = apiUrl.replace(/\/$/, '');
-    const useShieldKey = !auth.apiKey && !!(auth.shieldId && auth.shieldKey);
+    const useShieldKey = !auth.preferApiKey && !!(auth.shieldId && auth.shieldKey);
     const url = useShieldKey ? `${base}/api/cli/discovery` : `${base}/api/cicd/discovery/mcp`;
     const headers = { 'Content-Type': 'application/json' };
     if (useShieldKey) {
@@ -668,11 +693,11 @@ async function discoverCommand(args, config) {
         const hasShieldCreds = !!(creds.shieldId && creds.shieldKey);
         if (!creds.apiKey && !hasShieldCreds) {
             if (!silent) {
-                console.error(`\n${COLOR.red}--upload needs credentials.${COLOR.reset} Run \`fullcourtdefense login --token <fleet-token>\` (or \`fullcourtdefense setup\`) first.`);
+                console.error(`\n${COLOR.red}--upload needs credentials.${COLOR.reset} Run \`fullcourtdefense login --token <fleet-enrollment-token>\` first.`);
             }
             process.exit(1);
         }
-        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey }, args.connectorName, uploadExtras);
+        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
     if (silent) {
         if (args.upload === 'true') {
@@ -714,7 +739,7 @@ async function discoverCommand(args, config) {
                 found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
                 for (const s of found) {
                     const col = riskColor(s.riskLevel);
-                    const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
+                    const target = s.command ? `${s.command} ${redactCommandArgs(s.args).join(' ')}`.trim() : (s.url || 'unknown');
                     console.log(`  ${col}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${s.serverName} — ${target} (${proxyStatusLabel(s.proxyStatus)})`);
                 }
                 console.log('');

package/dist/commands/hook.js

@@ -409,7 +409,7 @@ async function hookCommand(args, config) {
     // No Shield configured → allow (fail-open by design: a misconfigured machine
     // must not brick the developer's IDE).
     if (!shieldId) {
-        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense setup`).');
+        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense login --token <fleet-enrollment-token>`).');
     }
     // --- Action Policy enforcement for actions (shell / mcp / file / read) ---
     if (event === 'shell' || event === 'mcp' || event === 'file' || event === 'read') {

package/dist/commands/installCursorHook.js

@@ -168,7 +168,7 @@ async function installCursorHookCommand(args, config) {
         console.log(`${COLOR.gray}Creds:${COLOR.reset} ${credFile}`);
     if (!creds.shieldId) {
         console.log('');
-        console.log(`${COLOR.yellow}No Shield ID set.${COLOR.reset} Run ${COLOR.bold}fullcourtdefense setup${COLOR.reset} first, then re-run install.`);
+        console.log(`${COLOR.yellow}No Shield ID set.${COLOR.reset} Run ${COLOR.bold}fullcourtdefense login --token <fleet-enrollment-token>${COLOR.reset} first, then re-run install.`);
     }
     console.log('');
     (0, restartNotice_1.printRestartNotice)('Cursor');

package/dist/commands/mcpGateway.js

@@ -172,7 +172,7 @@ function resolveGatewayConfig(args, config, defaults = {}) {
         apiUrl: args.apiUrl,
     });
     if (!creds.shieldId) {
-        throw new Error('Missing Shield ID. Run `fullcourtdefense setup` once (saves org, API key, Shield ID, and Shield key to ~/.fullcourtdefense.yml).');
+        throw new Error('Missing Shield ID. Run `fullcourtdefense login --token <fleet-enrollment-token>` once (saves per-machine Shield credentials to ~/.fullcourtdefense.yml).');
     }
     const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
     const developerName = detectedDeveloperName(args);

package/dist/config.js

@@ -177,11 +177,11 @@ function loadConfig(configPath) {
             }
         }
     }
-    // Plain CLI usage is intentionally global: `fullcourtdefense setup` writes
-    // ~/.fullcourtdefense.yml, then `install-all` should use that same verified
-    // Shield from any repo. Project config is still supported for scan defaults
-    // and explicit `--config` workflows, but it must not silently override the
-    // user's one-time setup credentials.
+    // Plain CLI usage is intentionally global: `fullcourtdefense login --token ...`
+    // writes per-machine Shield credentials to ~/.fullcourtdefense.yml, then
+    // `install-all` should use that same enrolled Shield from any repo. Project
+    // config is still supported for scan defaults and explicit `--config`
+    // workflows, but it must not silently override the user's machine enrollment.
     return configPath
         ? mergeConfig(homeConfig, projectConfig)
         : mergeConfig(projectConfig, homeConfig);
@@ -237,7 +237,7 @@ function requireCliSetup(config, overrides = {}, options = {}) {
     if (requireOrganizationId && !creds.organizationId)
         missing.push('organizationId');
     if (missing.length > 0) {
-        throw new Error(`Missing ${missing.join(', ')}. Run \`fullcourtdefense setup\` once — it saves org, API key, Shield ID, and Shield key to ~/.fullcourtdefense.yml so you never pass them again.`);
+        throw new Error(`Missing ${missing.join(', ')}. Run \`fullcourtdefense login --token <fleet-enrollment-token>\` once — it saves per-machine Shield credentials to ~/.fullcourtdefense.yml so you never pass them again.`);
     }
     return creds;
 }

package/dist/index.js

@@ -112,9 +112,11 @@ function printHelp() {
   \x1b[1mCommands:\x1b[0m
     help        Show this onboarding guide and command reference.
     doctor      First step. Checks outbound HTTPS access to FullCourtDefense.
-    configure   Saves org API key, Organization ID, Shield ID, and Shield key to ~/.fullcourtdefense.yml.
-                After setup, other commands read credentials automatically — no --shield-id/--api-key needed.
-    setup       Same as configure — validates credentials against the server before saving.
+    login       Enrolls this machine with a fleet enrollment token and saves
+                per-machine Shield credentials to ~/.fullcourtdefense.yml.
+    configure   Legacy/manual setup: saves org API key, Organization ID,
+                Shield ID, and Shield key to ~/.fullcourtdefense.yml.
+    setup       Same as configure — manual fallback when not using fleet login.
     install-all One-click: protect existing MCP servers in every AI client and
                 install Cursor hooks for built-in Cursor actions. No folder path
                 or --mcp-command needed. Use --hooks false to skip Cursor hooks.
@@ -167,21 +169,23 @@ function printHelp() {
     init        Creates a starter .fullcourtdefense.yml config file.
 
   \x1b[1mNew User Process:\x1b[0m
-    1. In the web app, create a Shield.
-       Copy the Shield ID and Shield key from the Shield Integrate tab.
+    1. In the web app, an org admin creates a fleet enrollment token:
+       AI Fleet → Settings → Fleet enrollment token.
 
     2. Check outbound connectivity from the customer machine:
        fullcourtdefense doctor
        This confirms the machine can reach https://api.fullcourtdefense.ai over HTTPS.
 
-    3. Save org + Shield credentials locally (one time):
-       fullcourtdefense setup
-       Saves to ~/.fullcourtdefense.yml — install, discover --upload, scan, gateway, and hooks use it automatically.
+    3. Enroll this developer machine (one time):
+       fullcourtdefense login --token <fleet-enrollment-token>
+       Or set FCD_ENROLL_TOKEN and run: fullcourtdefense login
+       Saves per-machine Shield credentials to ~/.fullcourtdefense.yml —
+       install, discover --upload, scan, gateway, and hooks use it automatically.
 
     4. One-click protect every AI client on this machine with Action Policies:
        fullcourtdefense install-all
        Verify installs:
-       fullcourtdefense discover --surface mcp
+       fullcourtdefense protect-all --dry-run true
        Or install one client: fullcourtdefense install-cursor-mcp-gateway ...
 
     5. Run a guided local scan:
@@ -298,7 +302,7 @@ function printHelp() {
     $ fullcourtdefense install-claude-code-mcp-gateway --scope project --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-desktop-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense mcp-gateway --mcp-command npm --mcp-args "run mcp"
-    $ fullcourtdefense setup
+    $ fullcourtdefense login --token <fleet-enrollment-token>
     $ fullcourtdefense install-all
     $ fullcourtdefense install-all --auto-protect true --upload
     $ fullcourtdefense install-mcp-gateway --clients cursor,codex --mcp-command npm --mcp-args "run mcp"

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.2"
+  "version": "1.7.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {