calllint 1.5.0 → 1.6.0

package/dist/index.js

@@ -5360,8 +5360,7 @@ var WindsurfExtractor = class extends BaseAgentExtractor {
     return configs;
   }
   getUserConfigPath() {
-    const appDataDir = this.getAppDataDir();
-    return join10(appDataDir, "Windsurf", "mcp.json");
+    return join10(this.resolveHome(), ".codeium", "mcp_config.json");
   }
   createConfig(configPath) {
     const exists = this.isValidConfig(configPath);
@@ -8904,9 +8903,91 @@ function claudeCodeServerEntry(server) {
   return entry;
 }
 
+// ../../packages/install-planner/src/adapters/cursor.ts
+var CURSOR_HOST_ID = "cursor";
+var CURSOR_TIER = "A";
+var cursorAdapter = {
+  id: CURSOR_HOST_ID,
+  tier: CURSOR_TIER,
+  createPlan(ctx, upstream) {
+    return buildInstallPlan({ ...ctx, host: CURSOR_HOST_ID, tier: CURSOR_TIER }, upstream);
+  },
+  validatePlan(plan) {
+    return validatePlan(plan);
+  },
+  applyPlan(plan, ctx) {
+    return applyPlan({
+      plan,
+      approvalDigest: ctx.approvalDigest,
+      configPath: ctx.configPath,
+      backupPath: ctx.backupPath,
+      lockPath: ctx.lockPath,
+      fs: ctx.fs,
+      now: ctx.now
+    });
+  }
+};
+function cursorServerEntry(server) {
+  const entry = {};
+  if (server.url) {
+    entry["url"] = server.url;
+  } else if (server.command) {
+    entry["command"] = server.command;
+    entry["args"] = server.args ?? [];
+  }
+  if (server.envKeys && server.envKeys.length > 0) {
+    const env = {};
+    for (const k of [...server.envKeys].sort()) env[k] = "";
+    entry["env"] = env;
+  }
+  return entry;
+}
+
+// ../../packages/install-planner/src/adapters/windsurf.ts
+var WINDSURF_HOST_ID = "windsurf";
+var WINDSURF_TIER = "A";
+var windsurfAdapter = {
+  id: WINDSURF_HOST_ID,
+  tier: WINDSURF_TIER,
+  createPlan(ctx, upstream) {
+    return buildInstallPlan({ ...ctx, host: WINDSURF_HOST_ID, tier: WINDSURF_TIER }, upstream);
+  },
+  validatePlan(plan) {
+    return validatePlan(plan);
+  },
+  applyPlan(plan, ctx) {
+    return applyPlan({
+      plan,
+      approvalDigest: ctx.approvalDigest,
+      configPath: ctx.configPath,
+      backupPath: ctx.backupPath,
+      lockPath: ctx.lockPath,
+      fs: ctx.fs,
+      now: ctx.now
+    });
+  }
+};
+function windsurfServerEntry(server) {
+  const entry = {};
+  if (server.url) {
+    entry["serverUrl"] = server.url;
+  } else if (server.command) {
+    entry["command"] = server.command;
+    entry["args"] = server.args ?? [];
+  }
+  if (server.envKeys && server.envKeys.length > 0) {
+    const env = {};
+    for (const k of [...server.envKeys].sort()) env[k] = "";
+    entry["env"] = env;
+  }
+  return entry;
+}
+
 // ../../packages/install-planner/src/index.ts
 var HOST_ADAPTERS = {
-  [claudeCodeAdapter.id]: claudeCodeAdapter
+  [claudeCodeAdapter.id]: claudeCodeAdapter,
+  [cursorAdapter.id]: cursorAdapter,
+  [windsurfAdapter.id]: windsurfAdapter
 };
 function getHostAdapter(host) {
   return HOST_ADAPTERS[host] ?? null;
@@ -9081,8 +9162,10 @@ function buildAuthorityForTarget(input, artifactDigest) {
   }
   return buildAuthorityManifest({ artifactDigest, servers, surfaces });
 }
-function defaultHostConfigPath(host) {
+function defaultHostConfigPath(host, cwd) {
   if (host === CLAUDE_CODE_HOST_ID) return join16(homedir(), ".claude.json");
+  if (host === CURSOR_HOST_ID) return join16(cwd, ".cursor", "mcp.json");
+  if (host === WINDSURF_HOST_ID) return join16(homedir(), ".codeium", "mcp_config.json");
   return null;
 }
 function plannedServersFor(input, host) {
@@ -9093,19 +9176,25 @@ function plannedServersFor(input, host) {
   } catch {
     return [];
   }
+  const entryByHost = {
+    [CLAUDE_CODE_HOST_ID]: claudeCodeServerEntry,
+    [CURSOR_HOST_ID]: cursorServerEntry,
+    [WINDSURF_HOST_ID]: windsurfServerEntry
+  };
+  const entryFor = entryByHost[host] ?? claudeCodeServerEntry;
   return servers.map((s) => ({
     name: s.name,
-    entry: claudeCodeServerEntry({ command: s.command, args: s.args, url: s.url, envKeys: s.envKeys })
+    entry: entryFor({ command: s.command, args: s.args, url: s.url, envKeys: s.envKeys })
   }));
 }
 function buildPlanForHost(host, input, artifactDigest, authority, decision, deps, configPathOverride) {
   const adapter = getHostAdapter(host);
   if (!adapter) {
-    return { error: `Unknown host "${host}". Known hosts: ${CLAUDE_CODE_HOST_ID}`, exitCode: EXIT.USAGE };
+    return { error: `Unknown host "${host}". Known hosts: ${knownHostList()}`, exitCode: EXIT.USAGE };
   }
   const servers = plannedServersFor(input, host);
   if (servers.length === 0) return null;
-  const configPath = configPathOverride ? resolvePath4(deps.cwd, configPathOverride) : defaultHostConfigPath(host);
+  const configPath = configPathOverride ? resolvePath4(deps.cwd, configPathOverride) : defaultHostConfigPath(host, deps.cwd);
   if (!configPath) {
     return { error: `No default config path known for host "${host}"; pass --host-config <path>`, exitCode: EXIT.USAGE };
   }
@@ -9308,7 +9397,7 @@ function trustApply(args, deps) {
     return { stdout: "", stderr: `Not a calllint.install-plan.v1 document: ${planFile}`, exitCode: EXIT.ERROR };
   }
   const adapter = getHostAdapter(plan.host);
-  if (!adapter) return usageErr(`Unknown host "${plan.host}". Known hosts: ${CLAUDE_CODE_HOST_ID}`);
+  if (!adapter) return usageErr(`Unknown host "${plan.host}". Known hosts: ${knownHostList()}`);
   if (!adapter.applyPlan) {
     return usageErr(`Host "${plan.host}" is tier ${adapter.tier} \u2014 plan-only; copy the patch or use a Tier-A host to apply.`);
   }
@@ -9707,6 +9796,15 @@ The write could not be verified AND the automatic rollback failed. Your
   }
   return out;
 }
+function hostHelpDescriptions() {
+  return Object.values(HOST_ADAPTERS).map((a) => {
+    const capability = a.applyPlan ? `Tier ${a.tier}, applies` : `Tier ${a.tier}, plan-only \u2014 you apply the emitted patch`;
+    return `${a.id} (${capability})`;
+  }).join("; ");
+}
+function knownHostList() {
+  return Object.keys(HOST_ADAPTERS).join(", ");
+}
 function trustHelp() {
   return `
 calllint trust \u2014 Automated Trust Gateway (prepare \u2192 approve \u2192 apply \u2192 verify)
@@ -9738,10 +9836,12 @@ OPTIONS (prepare)
   --format json|sarif   Force the evidence format (default: auto-detect)
   --provider <name>     Force the evidence provider adapter (default: auto-detect)
   --policy <file>       Use a policy file for the decision (default: built-in defaults)
-  --host <id>           Build an install plan for a host (G5: claude-code). Reads
-                        the host config READ-ONLY; never applies. Plan is emitted
-                        only for a non-blocking decision (SAFE/REVIEW).
-  --host-config <path>  Override the host config path (default: ~/.claude.json)
+  --host <id>           Build an install plan for a host \u2014 ${hostHelpDescriptions()}.
+                        Reads the host config READ-ONLY; never applies here. Plan
+                        is emitted only for a non-blocking decision.
+  --host-config <path>  Override the host config path (default: per host \u2014
+                        ~/.claude.json for claude-code, .cursor/mcp.json for
+                        cursor, ~/.codeium/mcp_config.json for windsurf)
   --write-plan          Persist the plan to .calllint/plans/<plan-id>.json
   --flows               Show static toxic-flow paths (calllint.flow.v0) behind the
                         decision's TOXIC_FLOW_COMPOSITION reasons. With --json, emits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",