fullcourtdefense-cli 1.7.3 → 1.7.5

package/dist/commands/discover.js

@@ -511,6 +511,7 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
         } : undefined,
         secrets: extras?.secrets?.findings.slice(0, 100).map(sanitizeSecretForUpload),
         agentFiles: extras?.agentFiles?.slice(0, 100).map(sanitizeAgentFileForUpload),
+        scanScope: extras?.scanScope,
         servers: servers.map(s => ({
             serverName: s.serverName,
             command: s.command,
@@ -626,12 +627,19 @@ async function discoverCommand(args, config) {
             console.log('Removed daily desktop discovery schedule.');
         return;
     }
-    if (args.schedule === 'daily') {
+    if (args.schedule === 'daily' || args.schedule === 'logon') {
         const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
-        (0, discoverSchedule_1.installDailyDiscoverSchedule)({ userEmail: args.userEmail, hour: Number.isFinite(hour) ? hour : 9 });
+        const surface = surfaces.size === 4 ? 'all' : Array.from(surfaces).join(',');
+        (0, discoverSchedule_1.installDailyDiscoverSchedule)({
+            userEmail: args.userEmail,
+            hour: Number.isFinite(hour) ? hour : 9,
+            surface,
+            trigger: args.schedule,
+        });
         if (!silent) {
-            console.log(`Daily desktop discovery scheduled (runs discover --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
-            console.log('Requires FULLCOURTDEFENSE_API_KEY or apiKey in ~/.fullcourtdefense.yml');
+            const when = args.schedule === 'logon' ? 'at logon' : `daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00`;
+            console.log(`Desktop discovery scheduled ${when} (runs discover --surface ${surface} --upload --silent${args.userEmail ? ` --user-email ${args.userEmail}` : ''}).`);
+            console.log('Uses login Shield credentials or an explicit org API key.');
         }
         return;
     }
@@ -684,7 +692,30 @@ async function discoverCommand(args, config) {
         }, null, 2));
         return;
     }
-    const uploadExtras = { secrets, agentFiles, posture };
+    const home = os.homedir();
+    const uploadExtras = {
+        secrets,
+        agentFiles,
+        posture,
+        scanScope: {
+            surfaces: [...surfaces],
+            workingDirectory: cwd,
+            mcpConfigPaths: scanned.map(s => ({ ...s, exists: fs.existsSync(s.path) })),
+            included: [
+                `Current command folder: ${cwd}`,
+                'Known MCP/AI client config files for Cursor, Claude, Codex, Gemini, Windsurf, and VS Code',
+                `User-level AI rules, skills, hooks, and instruction files under ${home}`,
+                `Credential stores and shell history under ${home}`,
+                `Environment files under ${cwd}, ${path.join(home, 'dev')}, ${path.join(home, 'repos')}, ${path.join(home, 'projects')}, ${path.join(home, 'Documents')}, and ${path.join(home, 'code')}`,
+            ],
+            excluded: [
+                'Unrelated project folders outside the listed roots',
+                'Large/generated dependency and build folders such as node_modules, .git, dist, build, vendor, caches, and temp folders',
+                'Full disk contents, browser profiles, email/chat archives, binary files, and operating-system folders',
+            ],
+            note: 'Desktop posture is a targeted AI-development exposure scan, not a full-device forensic scan. Run the command from the project folder you want represented.',
+        },
+    };
     async function maybeUpload() {
         if (args.upload !== 'true')
             return;

package/dist/commands/discoverSchedule.d.ts

@@ -1,6 +1,8 @@
 export interface ScheduleArgs {
     userEmail?: string;
     hour?: number;
+    surface?: string;
+    trigger?: 'daily' | 'logon';
 }
 export declare function installDailyDiscoverSchedule(args?: ScheduleArgs): void;
 export declare function uninstallDailyDiscoverSchedule(): void;

package/dist/commands/discoverSchedule.js

@@ -40,33 +40,56 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const TASK_NAME = 'FullCourtDefenseDesktopDiscover';
-function discoverCommandLine(userEmail) {
+const STARTUP_LAUNCHER = 'FullCourtDefenseDesktopDiscover.cmd';
+function windowsStartupLauncherPath() {
+    const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
+    return path.join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', STARTUP_LAUNCHER);
+}
+function discoverCommandLine(userEmail, surface) {
     const node = process.execPath;
     const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
     const parts = [q(node), q(script), 'discover', '--upload', '--silent'];
+    if (surface)
+        parts.push('--surface', q(surface));
     if (userEmail)
         parts.push('--user-email', q(userEmail));
     return parts.join(' ');
 }
-function installWindowsSchedule(hour, userEmail) {
-    const tr = discoverCommandLine(userEmail);
-    const st = `${String(hour).padStart(2, '0')}:00`;
+function installWindowsSchedule(hour, userEmail, surface, trigger = 'daily') {
+    const tr = discoverCommandLine(userEmail, surface);
     try {
         (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'ignore' });
     }
     catch {
         // task may not exist
     }
-    (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" /SC DAILY /ST ${st} /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
+    const schedule = trigger === 'logon'
+        ? '/SC ONLOGON'
+        : `/SC DAILY /ST ${String(hour).padStart(2, '0')}:00`;
+    try {
+        (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" ${schedule} /RL LIMITED /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
+    }
+    catch (error) {
+        if (trigger !== 'logon')
+            throw error;
+        const launcher = windowsStartupLauncherPath();
+        fs.mkdirSync(path.dirname(launcher), { recursive: true });
+        fs.writeFileSync(launcher, `@echo off\r\n${tr} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
+        console.log(`Task Scheduler denied access; installed user logon launcher instead: ${launcher}`);
+    }
 }
-function installMacSchedule(hour, userEmail) {
+function installMacSchedule(hour, userEmail, surface, trigger = 'daily') {
     const label = 'ai.fullcourtdefense.discover';
     const plistDir = path.join(os.homedir(), 'Library', 'LaunchAgents');
     const plistPath = path.join(plistDir, `${label}.plist`);
     fs.mkdirSync(plistDir, { recursive: true });
-    const cmd = discoverCommandLine(userEmail).split(/\s+/);
+    const cmd = discoverCommandLine(userEmail, surface).split(/\s+/);
     const program = cmd.shift() || process.execPath;
+    const triggerXml = trigger === 'logon'
+        ? '<key>RunAtLoad</key><true/>'
+        : `<key>StartCalendarInterval</key>
+  <dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>0</integer></dict>`;
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -74,8 +97,7 @@ function installMacSchedule(hour, userEmail) {
   <key>Label</key><string>${label}</string>
   <key>ProgramArguments</key>
   <array>${[program, ...cmd].map(part => `<string>${part.replace(/&/g, '&amp;').replace(/</g, '&lt;')}</string>`).join('')}</array>
-  <key>StartCalendarInterval</key>
-  <dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>0</integer></dict>
+  ${triggerXml}
   <key>StandardOutPath</key><string>${path.join(os.homedir(), '.fullcourtdefense-discover.log')}</string>
   <key>StandardErrorPath</key><string>${path.join(os.homedir(), '.fullcourtdefense-discover.err.log')}</string>
 </dict>
@@ -84,8 +106,9 @@ function installMacSchedule(hour, userEmail) {
     (0, child_process_1.spawnSync)('launchctl', ['unload', plistPath], { stdio: 'ignore' });
     (0, child_process_1.spawnSync)('launchctl', ['load', plistPath], { stdio: 'inherit' });
 }
-function installLinuxCron(hour, userEmail) {
-    const line = `0 ${hour} * * * ${discoverCommandLine(userEmail)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
+function installLinuxCron(hour, userEmail, surface, trigger = 'daily') {
+    const schedule = trigger === 'logon' ? '@reboot' : `0 ${hour} * * *`;
+    const line = `${schedule} ${discoverCommandLine(userEmail, surface)} >> ${path.join(os.homedir(), '.fullcourtdefense-discover.log')} 2>&1`;
     const marker = '# fullcourtdefense-discover';
     let crontab = '';
     try {
@@ -101,16 +124,30 @@ function installLinuxCron(hour, userEmail) {
 }
 function installDailyDiscoverSchedule(args = {}) {
     const hour = Number.isFinite(args.hour) ? Math.min(23, Math.max(0, args.hour)) : 9;
+    const trigger = args.trigger || 'daily';
     if (process.platform === 'win32')
-        installWindowsSchedule(hour, args.userEmail);
+        installWindowsSchedule(hour, args.userEmail, args.surface, trigger);
     else if (process.platform === 'darwin')
-        installMacSchedule(hour, args.userEmail);
+        installMacSchedule(hour, args.userEmail, args.surface, trigger);
     else
-        installLinuxCron(hour, args.userEmail);
+        installLinuxCron(hour, args.userEmail, args.surface, trigger);
 }
 function uninstallDailyDiscoverSchedule() {
     if (process.platform === 'win32') {
-        (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'inherit' });
+        try {
+            (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'inherit' });
+        }
+        catch {
+            // Scheduled Task may not exist or may be inaccessible.
+        }
+        try {
+            const launcher = windowsStartupLauncherPath();
+            if (fs.existsSync(launcher))
+                fs.unlinkSync(launcher);
+        }
+        catch {
+            // ignore
+        }
         return;
     }
     if (process.platform === 'darwin') {

package/dist/index.js

@@ -124,6 +124,7 @@ function printHelp() {
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
+                Use --schedule logon to upload inventory/posture at machine login.
     install-cursor-hook
                 Installs a Cursor hook so EVERY agent action on this machine is
                 checked against your org's Action Policies — in any repo/folder.
@@ -305,6 +306,7 @@ function printHelp() {
     $ fullcourtdefense login --token <fleet-enrollment-token>
     $ fullcourtdefense install-all
     $ fullcourtdefense install-all --auto-protect true --upload
+    $ fullcourtdefense discover --surface all --upload --schedule logon
     $ fullcourtdefense install-mcp-gateway --clients cursor,codex --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-codex-mcp-gateway --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense scan --system-prompt ./prompts/system.md --fail-threshold 80

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.7.3"
+  "version": "1.7.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {