fullcourtdefense-cli 1.1.12 → 1.1.14

package/README.md

@@ -167,6 +167,8 @@ Local scans run from the customer machine or VPN and only send captured text out
 | `--mcp-api-key <key>` | HTTP/SSE MCP API-key auth | API key value. | prompt |
 | `--progress <mode>` | MCP | Console progress: `verbose`, `compact`, or `silent`. | `verbose` |
 | `--server-name <name>` | MCP gateway installers | MCP server name to write into the client config. | `agentguard-gateway` |
+| `--developer-name <name>` | MCP gateway installers | Runtime identity used for user-scoped Action Policies. Auto-detected from `FCD_DEVELOPER_NAME`, git email, npm username, or OS username. | auto |
+| `--agent-name <name>` | MCP gateway installers | Runtime agent name shown in AI Users. Auto-generated from runtime identity plus client, e.g. `boaz.lautman-claude-desktop`. | auto |
 | `--scope <scope>` | Claude Code gateway installer | Claude Code MCP scope: `local`, `project`, or `user`. | `local` |
 | `--config-path <path>` | Claude Desktop gateway installer | Override path to `claude_desktop_config.json`. | OS default |
 
@@ -328,6 +330,8 @@ Claude Desktop install:
 fullcourtdefense install-claude-desktop-mcp-gateway --shield-id "sh_..." --shield-key "shsk_..." --mcp-command npm --mcp-args "run mcp"
 ```
 
+The gateway auto-detects runtime identity when `--developer-name` is omitted. Detection order is `FCD_DEVELOPER_NAME`, `FULLCOURTDEFENSE_DEVELOPER_NAME`, `AGENTGUARD_DEVELOPER_NAME`, `USER_EMAIL`, `git config user.email`, `npm whoami`, then OS username. Use `--developer-name` only when you want to override the detected employee/runtime identity.
+
 Direct gateway run for debugging:
 
 ```powershell

package/dist/commands/mcpGateway.js

@@ -80,19 +80,68 @@ function normalizeAgentClient(value, fallback) {
         return value;
     return fallback;
 }
+/**
+ * Detect which agent client spawned this gateway process at runtime.
+ *
+ * Claude Code sets `CLAUDECODE=1` and `CLAUDE_CODE_SESSION_ID` in every stdio
+ * MCP subprocess it starts, so a gateway launched by Claude Code can self-label
+ * even when it was installed with no explicit `--agent-client`. Cursor and
+ * Claude Desktop don't expose a runtime marker, so they fall through to the
+ * install-time default baked into the MCP config.
+ */
+function detectRuntimeAgentClient() {
+    if (process.env.CLAUDECODE === '1' || process.env.CLAUDE_CODE_SESSION_ID)
+        return 'claude-code';
+    return undefined;
+}
+/** Claude Code passes the session id to spawned MCP servers for correlation. */
+function runtimeSessionId() {
+    return firstNonEmpty(process.env.CLAUDE_CODE_SESSION_ID, process.env.FCD_SESSION_ID);
+}
+function firstNonEmpty(...values) {
+    return values.map(value => value?.trim()).find(Boolean);
+}
+function safeIdentityPart(value) {
+    return value
+        .trim()
+        .replace(/@.*$/, '')
+        .replace(/[^a-zA-Z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .toLowerCase() || 'local-user';
+}
+/**
+ * Resolve the developer identity for runtime attribution.
+ *
+ * Same behavior for Cursor, Claude Code, and Claude Desktop: prefer an explicit
+ * name (flag or env var IT can set per machine), otherwise fall back to
+ * `username@hostname` — exactly like the Cursor hook. We intentionally do NOT
+ * guess from git email / npm whoami: neither Cursor nor Claude exposes the
+ * account email, so the machine-scoped login is the one stable, predictable,
+ * collision-free identity.
+ */
+function detectedDeveloperName(args) {
+    return firstNonEmpty(args.developerName, process.env.FCD_DEVELOPER_NAME, process.env.FULLCOURTDEFENSE_DEVELOPER_NAME, process.env.AGENTGUARD_DEVELOPER_NAME, machineScopedUser()) || 'unknown';
+}
+function defaultAgentName(agentClient, developerName, defaults) {
+    if (defaults.agentName)
+        return defaults.agentName;
+    const prefix = defaults.agentNamePrefix || agentClient;
+    return `${safeIdentityPart(developerName)}-${prefix}`;
+}
 function resolveGatewayConfig(args, config, defaults = {}) {
     const home = loadHomeShield();
     const shieldId = args.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID || process.env.AGENTGUARD_SHIELD_ID || config.shieldId || home.shieldId;
     if (!shieldId)
         throw new Error('Missing Shield ID. Pass --shield-id or run fullcourtdefense configure.');
-    const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT, defaults.agentClient || 'cursor');
+    const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
+    const developerName = detectedDeveloperName(args);
     return {
         shieldId,
         shieldKey: args.shieldKey || process.env.FCD_SHIELD_KEY || process.env.FULLCOURTDEFENSE_SHIELD_KEY || process.env.AGENTGUARD_SHIELD_KEY || config.shieldKey || home.shieldKey,
         apiUrl: (args.apiUrl || process.env.FCD_API_URL || process.env.FULLCOURTDEFENSE_API_URL || config.apiUrl || home.apiUrl || DEFAULT_API_URL).replace(/\/$/, ''),
-        agentName: args.agentName || process.env.FCD_AGENT_NAME || defaults.agentName || 'cursor-local-agent',
+        agentName: args.agentName || process.env.FCD_AGENT_NAME || defaultAgentName(agentClient, developerName, defaults),
         agentClient,
-        developerName: args.developerName || process.env.FCD_DEVELOPER_NAME || process.env.USER_EMAIL || safeUserName(),
+        developerName,
         environment: args.environment || process.env.FCD_ENVIRONMENT || 'developer-workstation',
         userObjective: args.userObjective || process.env.FCD_USER_OBJECTIVE || defaults.userObjective || 'Developer requested this action from Cursor.',
         authority: args.authority || process.env.FCD_AUTHORITY || 'developer',
@@ -104,15 +153,17 @@ function resolveGatewayConfig(args, config, defaults = {}) {
     };
 }
 function machineMetadata(developerName, agentClient = 'cursor') {
+    const sessionId = runtimeSessionId();
     return {
-        developerName: developerName || safeUserName(),
+        developerName: developerName || machineScopedUser(),
         machineName: os.hostname(),
         os: `${os.platform()} ${os.release()}`,
         username: safeUserName(),
         ipAddress: firstPrivateIp(),
         cwd: process.cwd(),
-        workspacePath: process.env.WORKSPACE_PATH || process.cwd(),
+        workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
         agentClient,
+        ...(sessionId ? { sessionId } : {}),
         gateway: 'agentguard-mcp-gateway',
     };
 }
@@ -134,6 +185,25 @@ function safeUserName() {
         return 'unknown';
     }
 }
+/**
+ * Machine-scoped identity: `username@hostname` (e.g. `boazl@BOAZ-PC`).
+ *
+ * Bare OS usernames collide across machines (every laptop has an `admin` /
+ * `user`), which breaks per-person attribution and fails SOC 2 CC6.1
+ * non-repudiation. Pairing the login with the hostname makes the identity
+ * unique per device with zero config, and matches the Cursor hook's format.
+ * For verified corporate identity, set `FCD_DEVELOPER_NAME` (e.g. via MDM/IdP).
+ */
+function machineScopedUser() {
+    const user = safeUserName();
+    try {
+        const host = os.hostname();
+        return host ? `${user}@${host}` : user;
+    }
+    catch {
+        return user;
+    }
+}
 function summarizeToolArgs(args, developerName, agentClient = 'cursor') {
     const out = { ...machineMetadata(developerName, agentClient) };
     for (const [key, value] of Object.entries(args || {})) {
@@ -613,7 +683,7 @@ function normalizeClaudeCodeScope(scope) {
 async function installCursorMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'cursor',
-        agentName: 'cursor-local-agent',
+        agentNamePrefix: 'cursor',
         userObjective: 'Developer requested this action from Cursor.',
     });
     const projectScope = args.project === 'true';
@@ -635,7 +705,7 @@ async function installCursorMcpGatewayCommand(args, config) {
 async function installClaudeCodeMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-code',
-        agentName: 'claude-code-local-agent',
+        agentNamePrefix: 'claude-code',
         userObjective: 'Developer requested this action from Claude Code.',
     });
     const scope = normalizeClaudeCodeScope(args.scope);
@@ -680,7 +750,7 @@ async function installClaudeCodeMcpGatewayCommand(args, config) {
 async function installClaudeDesktopMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-desktop',
-        agentName: 'claude-desktop-local-agent',
+        agentNamePrefix: 'claude-desktop',
         userObjective: 'Developer requested this action from Claude Desktop.',
     });
     const file = args.configPath ? path.resolve(args.configPath) : claudeDesktopMcpPath();

package/dist/index.js

@@ -11,7 +11,7 @@ const discover_1 = require("./commands/discover");
 const hook_1 = require("./commands/hook");
 const installCursorHook_1 = require("./commands/installCursorHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
-const VERSION = '1.1.12';
+const VERSION = '1.1.14';
 function parseArgs(argv) {
     const flags = {};
     let command = '';
@@ -148,6 +148,8 @@ function printHelp() {
     --mcp-args <args>       MCP server args/path, for example ./server.js
     --mcp-tool <tool>       MCP tool to test, or all
     --server-name <name>    MCP gateway server name for client installers
+    --developer-name <name> Runtime identity for user-scoped policies (auto-detected if omitted)
+    --agent-name <name>     Runtime agent name (auto-generated from identity + client if omitted)
     --scope <scope>         Claude Code MCP scope: local, project, or user
     --config-path <path>    Claude Desktop config override path
     --mcp-auth-type <type>  HTTP MCP auth: none, bearer, basic, api-key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.1.12",
+  "version": "1.1.14",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {