fullcourtdefense-cli 1.1.13 → 1.1.15

package/dist/commands/discover.js

@@ -44,6 +44,7 @@ const SECRET_KEY = /key|token|secret|password|credential|api[_-]?key/i;
 function candidateConfigPaths(cwd, extra) {
     const home = os.homedir();
     const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+    const localAppData = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
     const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
     const list = [
         // Cursor
@@ -64,6 +65,22 @@ function candidateConfigPaths(cwd, extra) {
         { path: path.join(cwd, '.mcp.json'), source: 'Repo (.mcp.json)' },
         { path: path.join(cwd, 'mcp.json'), source: 'Repo (mcp.json)' },
     ];
+    if (process.platform === 'win32') {
+        const packagesDir = path.join(localAppData, 'Packages');
+        try {
+            for (const packageName of fs.readdirSync(packagesDir)) {
+                if (!/^Claude_/i.test(packageName))
+                    continue;
+                list.push({
+                    path: path.join(packagesDir, packageName, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json'),
+                    source: 'Claude Desktop (win MSIX)',
+                });
+            }
+        }
+        catch {
+            // Missing Packages directory is normal on non-Store installs.
+        }
+    }
     if (extra)
         list.push({ path: path.resolve(extra), source: 'Custom path' });
     return list;

package/dist/commands/mcpGateway.d.ts

@@ -29,7 +29,14 @@ export interface InstallClaudeDesktopMcpGatewayArgs extends McpGatewayArgs {
     configPath?: string;
     serverName?: string;
 }
+export interface InstallMcpGatewayArgs extends McpGatewayArgs {
+    clients?: string;
+    cursorProject?: string;
+    claudeCodeScope?: string;
+    serverName?: string;
+}
 export declare function mcpGatewayCommand(args: McpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installCursorMcpGatewayCommand(args: InstallCursorMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
+export declare function installMcpGatewayCommand(args: InstallMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installClaudeCodeMcpGatewayCommand(args: InstallClaudeCodeMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installClaudeDesktopMcpGatewayCommand(args: InstallClaudeDesktopMcpGatewayArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/mcpGateway.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mcpGatewayCommand = mcpGatewayCommand;
 exports.installCursorMcpGatewayCommand = installCursorMcpGatewayCommand;
+exports.installMcpGatewayCommand = installMcpGatewayCommand;
 exports.installClaudeCodeMcpGatewayCommand = installClaudeCodeMcpGatewayCommand;
 exports.installClaudeDesktopMcpGatewayCommand = installClaudeDesktopMcpGatewayCommand;
 const fs = __importStar(require("fs"));
@@ -80,24 +81,27 @@ function normalizeAgentClient(value, fallback) {
         return value;
     return fallback;
 }
+/**
+ * Detect which agent client spawned this gateway process at runtime.
+ *
+ * Claude Code sets `CLAUDECODE=1` and `CLAUDE_CODE_SESSION_ID` in every stdio
+ * MCP subprocess it starts, so a gateway launched by Claude Code can self-label
+ * even when it was installed with no explicit `--agent-client`. Cursor and
+ * Claude Desktop don't expose a runtime marker, so they fall through to the
+ * install-time default baked into the MCP config.
+ */
+function detectRuntimeAgentClient() {
+    if (process.env.CLAUDECODE === '1' || process.env.CLAUDE_CODE_SESSION_ID)
+        return 'claude-code';
+    return undefined;
+}
+/** Claude Code passes the session id to spawned MCP servers for correlation. */
+function runtimeSessionId() {
+    return firstNonEmpty(process.env.CLAUDE_CODE_SESSION_ID, process.env.FCD_SESSION_ID);
+}
 function firstNonEmpty(...values) {
     return values.map(value => value?.trim()).find(Boolean);
 }
-function commandOutput(command, args) {
-    try {
-        const result = (0, child_process_1.spawnSync)(command, args, {
-            encoding: 'utf8',
-            shell: process.platform === 'win32',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        if (result.status !== 0)
-            return undefined;
-        return result.stdout?.trim() || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 function safeIdentityPart(value) {
     return value
         .trim()
@@ -106,8 +110,18 @@ function safeIdentityPart(value) {
         .replace(/^-+|-+$/g, '')
         .toLowerCase() || 'local-user';
 }
+/**
+ * Resolve the developer identity for runtime attribution.
+ *
+ * Same behavior for Cursor, Claude Code, and Claude Desktop: prefer an explicit
+ * name (flag or env var IT can set per machine), otherwise fall back to
+ * `username@hostname` — exactly like the Cursor hook. We intentionally do NOT
+ * guess from git email / npm whoami: neither Cursor nor Claude exposes the
+ * account email, so the machine-scoped login is the one stable, predictable,
+ * collision-free identity.
+ */
 function detectedDeveloperName(args) {
-    return firstNonEmpty(args.developerName, process.env.FCD_DEVELOPER_NAME, process.env.FULLCOURTDEFENSE_DEVELOPER_NAME, process.env.AGENTGUARD_DEVELOPER_NAME, process.env.USER_EMAIL, commandOutput('git', ['config', '--get', 'user.email']), commandOutput('npm', ['whoami']), safeUserName()) || 'unknown';
+    return firstNonEmpty(args.developerName, process.env.FCD_DEVELOPER_NAME, process.env.FULLCOURTDEFENSE_DEVELOPER_NAME, process.env.AGENTGUARD_DEVELOPER_NAME, machineScopedUser()) || 'unknown';
 }
 function defaultAgentName(agentClient, developerName, defaults) {
     if (defaults.agentName)
@@ -120,7 +134,7 @@ function resolveGatewayConfig(args, config, defaults = {}) {
     const shieldId = args.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID || process.env.AGENTGUARD_SHIELD_ID || config.shieldId || home.shieldId;
     if (!shieldId)
         throw new Error('Missing Shield ID. Pass --shield-id or run fullcourtdefense configure.');
-    const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT, defaults.agentClient || 'cursor');
+    const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
     const developerName = detectedDeveloperName(args);
     return {
         shieldId,
@@ -140,15 +154,17 @@ function resolveGatewayConfig(args, config, defaults = {}) {
     };
 }
 function machineMetadata(developerName, agentClient = 'cursor') {
+    const sessionId = runtimeSessionId();
     return {
-        developerName: developerName || safeUserName(),
+        developerName: developerName || machineScopedUser(),
         machineName: os.hostname(),
         os: `${os.platform()} ${os.release()}`,
         username: safeUserName(),
         ipAddress: firstPrivateIp(),
         cwd: process.cwd(),
-        workspacePath: process.env.WORKSPACE_PATH || process.cwd(),
+        workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
         agentClient,
+        ...(sessionId ? { sessionId } : {}),
         gateway: 'agentguard-mcp-gateway',
     };
 }
@@ -170,6 +186,25 @@ function safeUserName() {
         return 'unknown';
     }
 }
+/**
+ * Machine-scoped identity: `username@hostname` (e.g. `boazl@BOAZ-PC`).
+ *
+ * Bare OS usernames collide across machines (every laptop has an `admin` /
+ * `user`), which breaks per-person attribution and fails SOC 2 CC6.1
+ * non-repudiation. Pairing the login with the hostname makes the identity
+ * unique per device with zero config, and matches the Cursor hook's format.
+ * For verified corporate identity, set `FCD_DEVELOPER_NAME` (e.g. via MDM/IdP).
+ */
+function machineScopedUser() {
+    const user = safeUserName();
+    try {
+        const host = os.hostname();
+        return host ? `${user}@${host}` : user;
+    }
+    catch {
+        return user;
+    }
+}
 function summarizeToolArgs(args, developerName, agentClient = 'cursor') {
     const out = { ...machineMetadata(developerName, agentClient) };
     for (const [key, value] of Object.entries(args || {})) {
@@ -629,6 +664,16 @@ function writeMcpServerConfig(file, serverName, nodeExe, commandArgs) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
 }
+function dedupePaths(candidates) {
+    const seen = new Set();
+    return candidates.filter(candidate => {
+        const key = path.resolve(candidate.file).toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
 function claudeDesktopMcpPath() {
     const home = os.homedir();
     if (process.platform === 'win32') {
@@ -641,11 +686,128 @@ function claudeDesktopMcpPath() {
     const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
     return path.join(xdg, 'Claude', 'claude_desktop_config.json');
 }
+function claudeDesktopMsixCandidates() {
+    if (process.platform !== 'win32')
+        return [];
+    const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const packagesDir = path.join(localAppData, 'Packages');
+    let packageNames = [];
+    try {
+        packageNames = fs.readdirSync(packagesDir)
+            .filter(name => /^Claude_/i.test(name));
+    }
+    catch {
+        return [];
+    }
+    return packageNames.map(name => {
+        const file = path.join(packagesDir, name, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json');
+        return {
+            file,
+            source: 'Claude Desktop (Microsoft Store/MSIX)',
+            exists: fs.existsSync(file),
+        };
+    });
+}
+function claudeDesktopMcpCandidates() {
+    const documented = claudeDesktopMcpPath();
+    const normal = {
+        file: documented,
+        source: process.platform === 'win32'
+            ? 'Claude Desktop (Windows documented AppData)'
+            : process.platform === 'darwin'
+                ? 'Claude Desktop (macOS)'
+                : 'Claude Desktop (Linux/XDG)',
+        exists: fs.existsSync(documented),
+    };
+    // Store/MSIX Claude Desktop reads a virtualized AppData path. Prefer it when present.
+    return dedupePaths([
+        ...claudeDesktopMsixCandidates(),
+        normal,
+    ]);
+}
+function claudeDesktopInstallTargets(configPath) {
+    if (configPath) {
+        const file = path.resolve(configPath);
+        return [{ file, source: 'Claude Desktop (custom config path)', exists: fs.existsSync(file) }];
+    }
+    const candidates = claudeDesktopMcpCandidates();
+    const existing = candidates.filter(candidate => candidate.exists);
+    if (existing.length > 0)
+        return existing;
+    const msix = candidates.find(candidate => candidate.source.includes('MSIX'));
+    return [msix || candidates[candidates.length - 1] || {
+            file: claudeDesktopMcpPath(),
+            source: 'Claude Desktop',
+            exists: false,
+        }];
+}
 function normalizeClaudeCodeScope(scope) {
     if (scope === 'project' || scope === 'user' || scope === 'local')
         return scope;
     return 'local';
 }
+function parseClientList(value) {
+    const raw = (value || 'auto').trim().toLowerCase();
+    if (!raw || raw === 'auto')
+        return 'auto';
+    const aliases = {
+        cursor: 'cursor',
+        'claude-code': 'claude-code',
+        claude_code: 'claude-code',
+        code: 'claude-code',
+        'claude-desktop': 'claude-desktop',
+        claude_desktop: 'claude-desktop',
+        desktop: 'claude-desktop',
+    };
+    const requested = raw === 'all'
+        ? ['cursor', 'claude-code', 'claude-desktop']
+        : raw.split(',').map(part => part.trim()).filter(Boolean);
+    const clients = requested.map(client => aliases[client]);
+    const unknown = requested.filter((_, index) => !clients[index]);
+    if (unknown.length > 0)
+        throw new Error(`Unknown client(s): ${unknown.join(', ')}. Use auto, all, cursor, claude-code, claude-desktop.`);
+    return Array.from(new Set(clients));
+}
+function commandAvailable(command) {
+    const result = (0, child_process_1.spawnSync)(process.platform === 'win32' ? 'where' : 'command', process.platform === 'win32' ? [command] : ['-v', command], {
+        stdio: 'ignore',
+        shell: process.platform !== 'win32',
+    });
+    return result.status === 0;
+}
+function detectInstallClients(cursorProject) {
+    const clients = [];
+    const cursorGlobal = path.join(os.homedir(), '.cursor');
+    const cursorProjectDir = path.join(process.cwd(), '.cursor');
+    if (fs.existsSync(cursorGlobal) || fs.existsSync(cursorProjectDir) || cursorProject)
+        clients.push('cursor');
+    if (commandAvailable('claude'))
+        clients.push('claude-code');
+    if (claudeDesktopMcpCandidates().some(candidate => candidate.exists) || fs.existsSync(path.dirname(claudeDesktopMcpPath()))) {
+        clients.push('claude-desktop');
+    }
+    return clients;
+}
+function clientInstallArgs(args) {
+    return {
+        mcpCommand: args.mcpCommand,
+        mcpArgs: args.mcpArgs,
+        agentName: args.agentName,
+        agentClient: args.agentClient,
+        developerName: args.developerName,
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+        environment: args.environment,
+        userObjective: args.userObjective,
+        authority: args.authority,
+        approvalMode: args.approvalMode,
+        approvalTimeoutMs: args.approvalTimeoutMs,
+        approvalPollMs: args.approvalPollMs,
+        scanResponse: args.scanResponse,
+        failClosed: args.failClosed,
+    };
+}
 async function installCursorMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'cursor',
@@ -668,6 +830,45 @@ async function installCursorMcpGatewayCommand(args, config) {
     console.log(`Downstream: ${downstreamCommand} ${downstreamArgs.join(' ')}`);
     console.log('Restart Cursor or reload MCP servers to use the protected tools.');
 }
+async function installMcpGatewayCommand(args, config) {
+    const cursorProject = args.cursorProject === 'true';
+    const selection = parseClientList(args.clients);
+    const clients = selection === 'auto' ? detectInstallClients(cursorProject) : selection;
+    if (clients.length === 0) {
+        throw new Error('No supported MCP clients detected. Re-run with --clients all or a comma list such as cursor,claude-desktop.');
+    }
+    const baseArgs = clientInstallArgs(args);
+    const successes = [];
+    const failures = [];
+    for (const client of clients) {
+        try {
+            if (client === 'cursor') {
+                await installCursorMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName: args.serverName }, config);
+            }
+            else if (client === 'claude-code') {
+                await installClaudeCodeMcpGatewayCommand({ ...baseArgs, scope: args.claudeCodeScope, serverName: args.serverName }, config);
+            }
+            else {
+                await installClaudeDesktopMcpGatewayCommand({ ...baseArgs, serverName: args.serverName }, config);
+            }
+            successes.push(client);
+        }
+        catch (error) {
+            failures.push(`${client}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    console.log('');
+    console.log('AgentGuard one-install summary:');
+    console.log(`Installed: ${successes.length > 0 ? successes.join(', ') : 'none'}`);
+    if (failures.length > 0) {
+        console.log('Failed:');
+        for (const failure of failures)
+            console.log(`- ${failure}`);
+    }
+    console.log(`Runtime identity: ${detectedDeveloperName(args)}`);
+    console.log('Restart/reload each client to use the protected tools.');
+    console.log('Smoke test prompt: "Use lookup_customer to look up customer C-1001."');
+}
 async function installClaudeCodeMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-code',
@@ -719,7 +920,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
         agentNamePrefix: 'claude-desktop',
         userObjective: 'Developer requested this action from Claude Desktop.',
     });
-    const file = args.configPath ? path.resolve(args.configPath) : claudeDesktopMcpPath();
+    const targets = claudeDesktopInstallTargets(args.configPath);
     const nodeExe = process.execPath;
     const serverName = args.serverName || MANAGED_SERVER_NAME;
     const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
@@ -727,9 +928,13 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
     const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs);
-    writeMcpServerConfig(file, serverName, nodeExe, commandArgs);
+    for (const target of targets) {
+        writeMcpServerConfig(target.file, serverName, nodeExe, commandArgs);
+    }
     console.log('AgentGuard MCP Gateway installed for Claude Desktop.');
-    console.log(`Config: ${file}`);
+    for (const target of targets) {
+        console.log(`Config: ${target.file} (${target.source})`);
+    }
     console.log(`Server: ${serverName}`);
     console.log(`Downstream: ${downstreamCommand} ${downstreamArgs.join(' ')}`);
     console.log('Restart Claude Desktop to load the protected tools.');

package/dist/index.js

@@ -11,7 +11,7 @@ const discover_1 = require("./commands/discover");
 const hook_1 = require("./commands/hook");
 const installCursorHook_1 = require("./commands/installCursorHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
-const VERSION = '1.1.13';
+const VERSION = '1.1.15';
 function parseArgs(argv) {
     const flags = {};
     let command = '';
@@ -73,6 +73,9 @@ function printHelp() {
                 (shell, MCP) on this machine is scanned by your Shield.
     uninstall-cursor-hook
                 Removes the FullCourtDefense Cursor hook entries.
+    install-mcp-gateway
+                One command to install the AgentGuard MCP Gateway into detected
+                clients (Cursor, Claude Code, Claude Desktop).
     mcp-gateway
                 Runs a local MCP gateway that checks AgentGuard runtime/action
                 policies before forwarding tool calls to a real MCP server.
@@ -148,9 +151,13 @@ function printHelp() {
     --mcp-args <args>       MCP server args/path, for example ./server.js
     --mcp-tool <tool>       MCP tool to test, or all
     --server-name <name>    MCP gateway server name for client installers
+    --clients <list>        Gateway install clients: auto, all, cursor,
+                            claude-code, claude-desktop
     --developer-name <name> Runtime identity for user-scoped policies (auto-detected if omitted)
     --agent-name <name>     Runtime agent name (auto-generated from identity + client if omitted)
     --scope <scope>         Claude Code MCP scope: local, project, or user
+    --claude-code-scope <s> Claude Code scope for install-mcp-gateway
+    --cursor-project <bool> Cursor project config for install-mcp-gateway
     --config-path <path>    Claude Desktop config override path
     --mcp-auth-type <type>  HTTP MCP auth: none, bearer, basic, api-key
     --mcp-token <token>     HTTP MCP bearer token
@@ -198,6 +205,8 @@ function printHelp() {
     $ fullcourtdefense install-cursor-hook --events prompt,shell,mcp,file
     $ fullcourtdefense install-cursor-hook --project true       # this repo only
     $ fullcourtdefense uninstall-cursor-hook
+    $ fullcourtdefense install-mcp-gateway --clients auto --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
+    $ fullcourtdefense install-mcp-gateway --clients all --mcp-command node --mcp-args ./server.js
     $ fullcourtdefense install-cursor-mcp-gateway --project true --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-code-mcp-gateway --scope local --shield-id <id> --shield-key <key> --mcp-command npm --mcp-args "run mcp"
     $ fullcourtdefense install-claude-code-mcp-gateway --scope project --shield-id <id> --mcp-command npm --mcp-args "run mcp"
@@ -368,6 +377,31 @@ async function main() {
             await (0, mcpGateway_1.mcpGatewayCommand)(args, config);
             break;
         }
+        case 'install-mcp-gateway': {
+            const args = {
+                clients: flags.clients,
+                cursorProject: flags['cursor-project'],
+                claudeCodeScope: flags['claude-code-scope'] || flags.scope,
+                serverName: flags['server-name'],
+                mcpCommand: flags['mcp-command'],
+                mcpArgs: flags['mcp-args'],
+                agentName: flags['agent-name'],
+                developerName: flags['developer-name'],
+                shieldId: flags['shield-id'],
+                shieldKey: flags['shield-key'],
+                apiUrl: flags['api-url'],
+                environment: flags.environment,
+                userObjective: flags['user-objective'],
+                authority: flags.authority,
+                approvalMode: flags['approval-mode'],
+                approvalTimeoutMs: flags['approval-timeout-ms'],
+                approvalPollMs: flags['approval-poll-ms'],
+                scanResponse: flags['scan-response'],
+                failClosed: flags['fail-closed'],
+            };
+            await (0, mcpGateway_1.installMcpGatewayCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 project: flags.project,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.1.13",
+  "version": "1.1.15",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {