fullcourtdefense-cli 1.7.2 → 1.7.4

package/dist/commands/discover.js

@@ -64,6 +64,30 @@ function parseSurfaces(args) {
 }
 const SECRET_VALUE = /sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}/;
 const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
+const SECRET_ARG_NAME = /^(?:--?(?:shield-key|api-key|token|mcp-token|mcp-api-key|key|secret|password|credential)|(?:.*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL).*))$/i;
+function redactCommandArgs(args) {
+    const out = [];
+    let redactNext = false;
+    for (const arg of args || []) {
+        if (redactNext) {
+            out.push('[redacted]');
+            redactNext = false;
+            continue;
+        }
+        const eq = arg.indexOf('=');
+        if (eq > 0 && SECRET_ARG_NAME.test(arg.slice(0, eq))) {
+            out.push(`${arg.slice(0, eq + 1)}[redacted]`);
+            continue;
+        }
+        if (SECRET_ARG_NAME.test(arg)) {
+            out.push(arg);
+            redactNext = true;
+            continue;
+        }
+        out.push(arg.replace(SECRET_VALUE, '[redacted]'));
+    }
+    return out;
+}
 function machineFingerprint() {
     const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
     return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
@@ -505,10 +529,11 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
             tools: s.tools,
         })),
     };
-    // Prefer the org API key path; otherwise fall back to the Shield-key endpoint so
-    // `discover --upload` works straight from `login` credentials with no org key.
+    // Prefer the enrolled Shield-key endpoint when available so the zero-paste
+    // `login --token` flow works even if an older org API key remains in config.
+    // Passing --api-key is the explicit opt-in to the org API key path.
     const base = apiUrl.replace(/\/$/, '');
-    const useShieldKey = !auth.apiKey && !!(auth.shieldId && auth.shieldKey);
+    const useShieldKey = !auth.preferApiKey && !!(auth.shieldId && auth.shieldKey);
     const url = useShieldKey ? `${base}/api/cli/discovery` : `${base}/api/cicd/discovery/mcp`;
     const headers = { 'Content-Type': 'application/json' };
     if (useShieldKey) {
@@ -601,12 +626,19 @@ async function discoverCommand(args, config) {
             console.log('Removed daily desktop discovery schedule.');
         return;
     }
-    if (args.schedule === 'daily') {
+    if (args.schedule === 'daily' || args.schedule === 'logon') {
         const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
-        (0, discoverSchedule_1.installDailyDiscoverSchedule)({ userEmail: args.userEmail, hour: Number.isFinite(hour) ? hour : 9 });
+        const surface = surfaces.size === 4 ? 'all' : Array.from(surfaces).join(',');
+        (0, discoverSchedule_1.installDailyDiscoverSchedule)({
+            userEmail: args.userEmail,
+            hour: Number.isFinite(hour) ? hour : 9,
+            surface,
+            trigger: args.schedule,
+        });
         if (!silent) {
-            console.log(`Daily desktop discovery scheduled (runs discover --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
-            console.log('Requires FULLCOURTDEFENSE_API_KEY or apiKey in ~/.fullcourtdefense.yml');
+            const when = args.schedule === 'logon' ? 'at logon' : `daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00`;
+            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            console.log('Uses login Shield credentials or an explicit org API key.');
         }
         return;
     }
@@ -668,11 +700,11 @@ async function discoverCommand(args, config) {
         const hasShieldCreds = !!(creds.shieldId && creds.shieldKey);
         if (!creds.apiKey && !hasShieldCreds) {
             if (!silent) {
-                console.error(`\n${COLOR.red}--upload needs credentials.${COLOR.reset} Run \`fullcourtdefense login --token <fleet-token>\` (or \`fullcourtdefense setup\`) first.`);
+                console.error(`\n${COLOR.red}--upload needs credentials.${COLOR.reset} Run \`fullcourtdefense login --token <fleet-enrollment-token>\` first.`);
             }
             process.exit(1);
         }
-        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey }, args.connectorName, uploadExtras);
+        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
     }
     if (silent) {
         if (args.upload === 'true') {
@@ -714,7 +746,7 @@ async function discoverCommand(args, config) {
                 found.sort((a, b) => order[a.riskLevel] - order[b.riskLevel]);
                 for (const s of found) {
                     const col = riskColor(s.riskLevel);
-                    const target = s.command ? `${s.command} ${(s.args || []).join(' ')}`.trim() : (s.url || 'unknown');
+                    const target = s.command ? `${s.command} ${redactCommandArgs(s.args).join(' ')}`.trim() : (s.url || 'unknown');
                     console.log(`  ${col}[${s.riskLevel.toUpperCase()}]${COLOR.reset} ${s.serverName} — ${target} (${proxyStatusLabel(s.proxyStatus)})`);
                 }
                 console.log('');

package/dist/commands/discoverSchedule.d.ts

@@ -1,6 +1,8 @@
 export interface ScheduleArgs {
     userEmail?: string;
     hour?: number;
+    surface?: string;
+    trigger?: 'daily' | 'logon';
 }
 export declare function installDailyDiscoverSchedule(args?: ScheduleArgs): void;
 export declare function uninstallDailyDiscoverSchedule(): void;

package/dist/commands/discoverSchedule.js

@@ -40,33 +40,56 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const TASK_NAME = 'FullCourtDefenseDesktopDiscover';
-function discoverCommandLine(userEmail) {
+const STARTUP_LAUNCHER = 'FullCourtDefenseDesktopDiscover.cmd';
+function windowsStartupLauncherPath() {
+    const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
+    return path.join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', STARTUP_LAUNCHER);
+}
+function discoverCommandLine(userEmail, surface) {
     const node = process.execPath;
     const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
     const parts = [q(node), q(script), 'discover', '--upload', '--silent'];
+    if (surface)
+        parts.push('--surface', q(surface));
     if (userEmail)
         parts.push('--user-email', q(userEmail));
     return parts.join(' ');
 }
-function installWindowsSchedule(hour, userEmail) {
-    const tr = discoverCommandLine(userEmail);
-    const st = `${String(hour).padStart(2, '0')}:00`;
+function installWindowsSchedule(hour, userEmail, surface, trigger = 'daily') {
+    const tr = discoverCommandLine(userEmail, surface);
     try {
         (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'ignore' });
     }
     catch {
         // task may not exist
     }
-    (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" /SC DAILY /ST ${st} /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
+    const schedule = trigger === 'logon'
+        ? '/SC ONLOGON'
+        : `/SC DAILY /ST ${String(hour).padStart(2, '0')}:00`;
+    try {
+        (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" ${schedule} /RL LIMITED /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
+    }
+    catch (error) {
+        if (trigger !== 'logon')
+            throw error;
+        const launcher = windowsStartupLauncherPath();
+        fs.mkdirSync(path.dirname(launcher), { recursive: true });
+        fs.writeFileSync(launcher, `@echo off\r\n${tr} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
+        console.log(`Task Scheduler denied access; installed user logon launcher instead: ${launcher}`);
+    }
 }
-function installMacSchedule(hour, userEmail) {
+function installMacSchedule(hour, userEmail, surface, trigger = 'daily') {
     const label = 'ai.fullcourtdefense.discover';
     const plistDir = path.join(os.homedir(), 'Library', 'LaunchAgents');
     const plistPath = path.join(plistDir, `${label}.plist`);
     fs.mkdirSync(plistDir, { recursive: true });
-    const cmd = discoverCommandLine(userEmail).split(/\s+/);
+    const cmd = discoverCommandLine(userEmail, surface).split(/\s+/);
     const program = cmd.shift() || process.execPath;
+    const triggerXml = trigger === 'logon'
+        ? '<key>RunAtLoad</key><true/>'
+        : `<key>StartCalendarInterval</key>
+  <dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>0</integer></dict>`;
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -74,8 +97,7 @@ function installMacSchedule(hour, userEmail) {
   <key>Label</key><string>${label}</string>
   <key>ProgramArguments</key>
   <array>${[program, ...cmd].map(part => `<string>${part.replace(/&/g, '&amp;').replace(/</g, '&lt;')}</string>`).join('')}</array>
-  <key>StartCalendarInterval</key>
-  <dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>0</integer></dict>
+  ${triggerXml}
   <key>StandardOutPath</key><string>${path.join(os.homedir(), '.fullcourtdefense-discover.log')}</string>
   <key>StandardErrorPath</key><string>${path.join(os.homedir(), '.fullcourtdefense-discover.err.log')}</string>
 </dict>
@@ -84,8 +106,9 @@ function installMacSchedule(hour, userEmail) {
     (0, child_process_1.spawnSync)('launchctl', ['unload', plistPath], { stdio: 'ignore' });
     (0, child_process_1.spawnSync)('launchctl', ['load', plistPath], { stdio: 'inherit' });
 }
-function installLinuxCron(hour, userEmail) {
-    const line = `0 ${hour} * * * ${discoverCommandLine(userEmail)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
+function installLinuxCron(hour, userEmail, surface, trigger = 'daily') {
+    const schedule = trigger === 'logon' ? '@reboot' : `0 ${hour} * * *`;
+    const line = `${schedule} ${discoverCommandLine(userEmail, surface)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
     const marker = '# fullcourtdefense-discover';
     let crontab = '';
     try {
@@ -101,16 +124,30 @@ function installLinuxCron(hour, userEmail) {
 }
 function installDailyDiscoverSchedule(args = {}) {
     const hour = Number.isFinite(args.hour) ? Math.min(23, Math.max(0, args.hour)) : 9;
+    const trigger = args.trigger || 'daily';
     if (process.platform === 'win32')
-        installWindowsSchedule(hour, args.userEmail);
+        installWindowsSchedule(hour, args.userEmail, args.surface, trigger);
     else if (process.platform === 'darwin')
-        installMacSchedule(hour, args.userEmail);
+        installMacSchedule(hour, args.userEmail, args.surface, trigger);
     else
-        installLinuxCron(hour, args.userEmail);
+        installLinuxCron(hour, args.userEmail, args.surface, trigger);
 }
 function uninstallDailyDiscoverSchedule() {
     if (process.platform === 'win32') {
-        (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'inherit' });
+        try {
+            (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'inherit' });
+        }
+        catch {
+            // Scheduled Task may not exist or may be inaccessible.
+        }
+        try {
+            const launcher = windowsStartupLauncherPath();
+            if (fs.existsSync(launcher))
+                fs.unlinkSync(launcher);
+        }
+        catch {
+            // ignore
+        }
         return;
     }
     if (process.platform === 'darwin') {

package/dist/commands/hook.js

@@ -409,7 +409,7 @@ async function hookCommand(args, config) {
     // No Shield configured → allow (fail-open by design: a misconfigured machine
     // must not brick the developer's IDE).
     if (!shieldId) {
-        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense setup`).');
+        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense login --token <fleet-enrollment-token>`).');
     }
     // --- Action Policy enforcement for actions (shell / mcp / file / read) ---
     if (event === 'shell' || event === 'mcp' || event === 'file' || event === 'read') {

package/dist/commands/installCursorHook.js

@@ -168,7 +168,7 @@ async function installCursorHookCommand(args, config) {
         console.log(`${COLOR.gray}Creds:${COLOR.reset} ${credFile}`);
     if (!creds.shieldId) {
         console.log('');
-        console.log(`${COLOR.yellow}No Shield ID set.${COLOR.reset} Run ${COLOR.bold}fullcourtdefense setup${COLOR.reset} first, then re-run install.`);
+        console.log(`${COLOR.yellow}No Shield ID set.${COLOR.reset} Run ${COLOR.bold}fullcourtdefense login --token <fleet-enrollment-token>${COLOR.reset} first, then re-run install.`);
     }
     console.log('');
     (0, restartNotice_1.printRestartNotice)('Cursor');

package/dist/commands/mcpGateway.js

@@ -172,7 +172,7 @@ function resolveGatewayConfig(args, config, defaults = {}) {
         apiUrl: args.apiUrl,
     });
     if (!creds.shieldId) {
-        throw new Error('Missing Shield ID. Run `fullcourtdefense setup` once (saves org, API key, Shield ID, and Shield key to ~/.fullcourtdefense.yml).');
+        throw new Error('Missing Shield ID. Run `fullcourtdefense login --token <fleet-enrollment-token>` once (saves per-machine Shield credentials to ~/.fullcourtdefense.yml).');
     }
     const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
     const developerName = detectedDeveloperName(args);

package/dist/config.js

@@ -177,11 +177,11 @@ function loadConfig(configPath) {
             }
         }
     }
-    // Plain CLI usage is intentionally global: `fullcourtdefense setup` writes
-    // ~/.fullcourtdefense.yml, then `install-all` should use that same verified
-    // Shield from any repo. Project config is still supported for scan defaults
-    // and explicit `--config` workflows, but it must not silently override the
-    // user's one-time setup credentials.
+    // Plain CLI usage is intentionally global: `fullcourtdefense login --token ...`
+    // writes per-machine Shield credentials to ~/.fullcourtdefense.yml, then
+    // `install-all` should use that same enrolled Shield from any repo. Project
+    // config is still supported for scan defaults and explicit `--config`
+    // workflows, but it must not silently override the user's machine enrollment.
     return configPath
         ? mergeConfig(homeConfig, projectConfig)
         : mergeConfig(projectConfig, homeConfig);
@@ -237,7 +237,7 @@ function requireCliSetup(config, overrides = {}, options = {}) {
     if (requireOrganizationId && !creds.organizationId)
         missing.push('organizationId');
     if (missing.length > 0) {
-        throw new Error(`Missing ${missing.join(', ')}. Run \`fullcourtdefense setup\` once — it saves org, API key, Shield ID, and Shield key to ~/.fullcourtdefense.yml so you never pass them again.`);
+        throw new Error(`Missing ${missing.join(', ')}. Run \`fullcourtdefense login --token <fleet-enrollment-token>\` once — it saves per-machine Shield credentials to ~/.fullcourtdefense.yml so you never pass them again.`);
     }
     return creds;
 }

package/dist/index.js

@@ -112,9 +112,11 @@ function printHelp() {
   \x1b[1mCommands:\x1b[0m
     help        Show this onboarding guide and command reference.
     doctor      First step. Checks outbound HTTPS access to FullCourtDefense.
-    configure   Saves org API key, Organization ID, Shield ID, and Shield key to ~/.fullcourtdefense.yml.
-                After setup, other commands read credentials automatically — no --shield-id/--api-key needed.
-    setup       Same as configure — validates credentials against the server before saving.
+    login       Enrolls this machine with a fleet enrollment token and saves
+                per-machine Shield credentials to ~/.fullcourtdefense.yml.
+    configure   Legacy/manual setup: saves org API key, Organization ID,
+                Shield ID, and Shield key to ~/.fullcourtdefense.yml.
+    setup       Same as configure — manual fallback when not using fleet login.
     install-all One-click: protect existing MCP servers in every AI client and
                 install Cursor hooks for built-in Cursor actions. No folder path
                 or --mcp-command needed. Use --hooks false to skip Cursor hooks.
@@ -122,6 +124,7 @@ function printHelp() {
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
+                Use --schedule logon to upload inventory/posture at machine login.
     install-cursor-hook
                 Installs a Cursor hook so EVERY agent action on this machine is
                 checked against your org's Action Policies — in any repo/folder.
@@ -167,21 +170,23 @@ function printHelp() {
     init        Creates a starter .fullcourtdefense.yml config file.
 
   \x1b[1mNew User Process:\x1b[0m
-    1. In the web app, create a Shield.
-       Copy the Shield ID and Shield key from the Shield Integrate tab.
+    1. In the web app, an org admin creates a fleet enrollment token:
+       AI Fleet → Settings → Fleet enrollment token.
 
     2. Check outbound connectivity from the customer machine:
        fullcourtdefense doctor
        This confirms the machine can reach https://api.fullcourtdefense.ai over HTTPS.
 
-    3. Save org + Shield credentials locally (one time):
-       fullcourtdefense setup
-       Saves to ~/.fullcourtdefense.yml — install, discover --upload, scan, gateway, and hooks use it automatically.
+    3. Enroll this developer machine (one time):
+       fullcourtdefense login --token <fleet-enrollment-token>
+       Or set FCD_ENROLL_TOKEN and run: fullcourtdefense login
+       Saves per-machine Shield credentials to ~/.fullcourtdefense.yml —
+       install, discover --upload, scan, gateway, and hooks use it automatically.
 
     4. One-click protect every AI client on this machine with Action Policies:
        fullcourtdefense install-all
        Verify installs:
-       fullcourtdefense discover --surface mcp
+       fullcourtdefense protect-all --dry-run true
        Or install one client: fullcourtdefense install-cursor-mcp-gateway ...
 
     5. Run a guided local scan:
@@ -298,9 +303,10 @@ function printHelp() {
     $ fullcourtdefense install-claude-code-mcp-gateway --scope project --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-desktop-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense mcp-gateway --mcp-command npm --mcp-args "run mcp"
-    $ fullcourtdefense setup
+    $ fullcourtdefense login --token <fleet-enrollment-token>
     $ fullcourtdefense install-all
     $ fullcourtdefense install-all --auto-protect true --upload
+    $ fullcourtdefense discover --surface all --upload --schedule logon
     $ fullcourtdefense install-mcp-gateway --clients cursor,codex --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-codex-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense scan --system-prompt ./prompts/system.md --fail-threshold 80

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.2"
+  "version": "1.7.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {