fullcourtdefense-cli 1.18.8 → 1.18.10

package/dist/commands/deterministicGuard.js

@@ -489,7 +489,7 @@ function bareOrActionIntent(value, action) {
 }
 function scanDeterministicPrompt(text, options) {
     const trimmed = text.trim();
-    if (!trimmed || looksLikeQuestion(trimmed))
+    if (!trimmed)
         return undefined;
     const custom = customBlock(trimmed, options);
     if (custom)
@@ -506,6 +506,11 @@ function scanDeterministicPrompt(text, options) {
     if (contextualSecret) {
         return builtIn(contextualSecret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-contextual-secret', `Blocked prompt containing ${contextualSecret.label}.`, contextualSecret.value, contextualSecret.label, options);
     }
+    // Questions are benign for action-oriented rules below, but this check must
+    // happen AFTER secret detection: "is this my API secret: <value>?" still
+    // leaks a credential into agent context.
+    if (looksLikeQuestion(trimmed))
+        return undefined;
     const sensitivePath = containsSensitiveCredentialPath(trimmed);
     if (sensitivePath && bareOrActionIntent(trimmed, /\b(?:read|open|cat|show|print|copy|upload|send|exfiltrate)\b/i)) {
         return builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-prompt-sensitive-credential-path', `Blocked prompt targeting ${sensitivePath.label}.`, trimmed, sensitivePath.label, options);

package/dist/commands/hook.d.ts

@@ -27,6 +27,7 @@ export interface HookArgs {
     shadow?: string;
     enforce?: string;
     failClosed?: string;
+    localOnly?: string;
     timeout?: string;
     approvalMode?: string;
     approvalTimeoutMs?: string;

package/dist/commands/hook.js

@@ -459,6 +459,7 @@ async function hookCommand(args, config) {
     // (enforcing machines fail closed, monitor/shadow fail open) — resolved below.
     const failClosedExplicit = args.failClosed !== undefined;
     let failClosed = args.failClosed === 'true';
+    const localOnly = args.localOnly === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
     const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
     const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 900000;
@@ -654,6 +655,11 @@ async function hookCommand(args, config) {
             respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this prompt locally (${localBlock.ruleId}). Do not retry.`);
             return;
         }
+        if (localOnly) {
+            dbg({ phase: 'local_deterministic_prompt_allow', event });
+            respond(false);
+            return;
+        }
         await enforceShieldText({
             event, text, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, respond, client,

package/dist/commands/installAll.js

@@ -41,10 +41,10 @@ async function installAllCommand(args, config) {
             shieldKey: creds.shieldKey,
             apiUrl: creds.apiUrl,
             project: args.cursorProject,
-            // Scope is MCP/tool actions only — prompt text never leaves the machine.
+            // Prompt secrets are checked locally; prompt text never leaves the machine.
             // No failClosed flag: the offline stance is server-authoritative (from
             // the runtime bundle), unified with the Claude/VS Code hook below.
-            events: 'shell,mcp',
+            events: 'prompt,shell,mcp',
         };
         try {
             await (0, installCursorHook_1.installCursorHookCommand)(hookArgs, config);
@@ -59,9 +59,9 @@ async function installAllCommand(args, config) {
             shieldId: creds.shieldId,
             shieldKey: creds.shieldKey,
             apiUrl: creds.apiUrl,
-            // Tool actions only by default — same scope as the Cursor hooks. Prompt
-            // scanning stays opt-in (`install-claude-hook --events tools,prompt`).
-            events: 'tools',
+            // Prompt secrets are checked locally; tool actions retain their existing
+            // Action Policy + approval behavior.
+            events: 'tools,prompt',
         };
         try {
             await (0, installClaudeHook_1.installClaudeHookCommand)(claudeHookArgs, config);

package/dist/commands/installClaudeHook.js

@@ -119,12 +119,15 @@ function repairClaudeManagedHooks() {
     settings.hooks = hooks;
     let changed = false;
     if (before.managedEntries === 0) {
-        // Match install-all's privacy-preserving baseline: tool actions only.
-        // Prompt scanning remains an explicit opt-in and is preserved when present.
+        // Match install-all's privacy-preserving baseline: tool policies plus
+        // deterministic on-device prompt secret protection.
         const command = buildHookCommand({ shadow: false, failClosed: false });
         const tools = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
         tools.push({ matcher: '*', hooks: [{ type: 'command', command, timeout: 300 }] });
         hooks.PreToolUse = tools;
+        const prompts = Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : [];
+        prompts.push({ hooks: [{ type: 'command', command, timeout: 30 }] });
+        hooks.UserPromptSubmit = prompts;
         changed = true;
     }
     else {
@@ -135,6 +138,19 @@ function repairClaudeManagedHooks() {
                 changed = true;
             }
         }
+        const prompts = Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : [];
+        const hasManagedPrompt = prompts.some(entry => Array.isArray(entry.hooks) && entry.hooks.some(isManagedCommand));
+        if (!hasManagedPrompt) {
+            prompts.push({
+                hooks: [{
+                        type: 'command',
+                        command: buildHookCommand({ shadow: false, failClosed: false }),
+                        timeout: 30,
+                    }],
+            });
+            hooks.UserPromptSubmit = prompts;
+            changed = true;
+        }
     }
     if (changed) {
         fs.mkdirSync(path.dirname(before.file), { recursive: true });
@@ -169,7 +185,9 @@ function buildHookCommand(opts) {
     const scriptPath = process.argv[1] || path.join(__dirname, '..', 'index.js');
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
     // No --event flag: the bridge detects the Claude payload (hook_event_name) itself.
-    let cmd = `${q(nodeExe)} ${q(scriptPath)} hook --approval-mode wait`;
+    // local-only affects prompt events only; tool events still use the complete
+    // Action Policy/approval path. This keeps prompt text on the endpoint.
+    let cmd = `${q(nodeExe)} ${q(scriptPath)} hook --approval-mode wait --local-only true`;
     if (opts.shadow)
         cmd += ' --shadow true';
     if (opts.failClosed)
@@ -239,7 +257,7 @@ async function installClaudeHookCommand(args, config) {
     if (wantTools)
         parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');
     if (wantPrompt)
-        parts.push('prompts scanned by your Shield');
+        parts.push('prompts checked by deterministic Local Safety on-device (text is not uploaded)');
     console.log(`${COLOR.gray}Enforcement:${COLOR.reset} ${parts.join('; ')}`);
     if (shadow)
         console.log(`${COLOR.yellow}Mode: SHADOW (monitor only — nothing is blocked).${COLOR.reset}`);

package/dist/commands/installCursorHook.js

@@ -80,6 +80,8 @@ function buildHookCommand(flag, opts) {
         cmd += ' --shadow true';
     if (opts.failClosed)
         cmd += ' --fail-closed true';
+    if (opts.localOnly)
+        cmd += ' --local-only true';
     if (opts.waitForApproval)
         cmd += ' --approval-mode wait';
     cmd += ` ${MANAGED_MARKER}`;
@@ -145,12 +147,17 @@ function repairCursorManagedHooks() {
     const json = readHooksJson(before.file);
     let changed = false;
     if (before.managedEntries === 0) {
-        for (const event of ['shell', 'mcp']) {
+        for (const event of ['prompt', 'shell', 'mcp']) {
             const { hookKey, flag, timeoutSec } = EVENT_MAP[event];
             const list = Array.isArray(json.hooks[hookKey]) ? json.hooks[hookKey] : [];
             list.push({
                 // Offline stance comes from the runtime bundle at hook time.
-                command: buildHookCommand(flag, { shadow: false, failClosed: false, waitForApproval: true }),
+                command: buildHookCommand(flag, {
+                    shadow: false,
+                    failClosed: false,
+                    waitForApproval: event !== 'prompt',
+                    localOnly: event === 'prompt',
+                }),
                 timeout: timeoutSec,
             });
             json.hooks[hookKey] = list;
@@ -171,6 +178,25 @@ function repairCursorManagedHooks() {
                 }
             }
         }
+        // Existing managed installations predate prompt protection. Add only the
+        // missing local prompt entry; preserve every shell/MCP entry and unrelated
+        // customer hook exactly as-is.
+        const promptEntries = Array.isArray(json.hooks.beforeSubmitPrompt)
+            ? json.hooks.beforeSubmitPrompt
+            : [];
+        if (!promptEntries.some(isManaged)) {
+            promptEntries.push({
+                command: buildHookCommand('prompt', {
+                    shadow: false,
+                    failClosed: false,
+                    waitForApproval: false,
+                    localOnly: true,
+                }),
+                timeout: EVENT_MAP.prompt.timeoutSec,
+            });
+            json.hooks.beforeSubmitPrompt = promptEntries;
+            changed = true;
+        }
     }
     if (changed) {
         fs.mkdirSync(path.dirname(before.file), { recursive: true });
@@ -192,7 +218,7 @@ async function installCursorHookCommand(args, config) {
     const projectScope = args.project === 'true';
     const shadow = args.shadow === 'true';
     const file = hooksJsonPath(projectScope);
-    const requested = (args.events || 'shell,mcp')
+    const requested = (args.events || 'prompt,shell,mcp')
         .split(/[\s,]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
     const events = requested.filter((e) => EVENT_MAP[e]);
     if (events.length === 0) {
@@ -222,7 +248,14 @@ async function installCursorHookCommand(args, config) {
         // stance from the runtime bundle (same behavior as the Claude hook).
         const failClosed = e === 'prompt' ? false : args.failClosed === 'true';
         const entry = {
-            command: buildHookCommand(flag, { shadow, failClosed, waitForApproval: e !== 'prompt' }),
+            command: buildHookCommand(flag, {
+                shadow,
+                failClosed,
+                waitForApproval: e !== 'prompt',
+                // Prompt secrets are blocked entirely on-device. Benign prompt text is
+                // never sent to the Shield service by the managed default.
+                localOnly: e === 'prompt',
+            }),
             timeout: timeoutSec,
         };
         if (failClosed)
@@ -242,7 +275,7 @@ async function installCursorHookCommand(args, config) {
         console.log(`${COLOR.gray}Enforcement:${COLOR.reset} ${actionEvents.join(', ')} checked against your org Action Policies (allow / block / wait-for-human-approval) in every repo.`);
     }
     if (events.includes('prompt')) {
-        console.log(`${COLOR.gray}Prompts:${COLOR.reset} scanned by your Shield (developer-chat).`);
+        console.log(`${COLOR.gray}Prompts:${COLOR.reset} deterministic Local Safety scan on-device (prompt text is not uploaded).`);
     }
     if (shadow)
         console.log(`${COLOR.yellow}Mode: SHADOW (monitor only — nothing is blocked).${COLOR.reset}`);

package/dist/index.js

@@ -613,6 +613,7 @@ async function main() {
                 shadow: flags.shadow,
                 enforce: flags.enforce,
                 failClosed: flags['fail-closed'],
+                localOnly: flags['local-only'],
                 timeout: flags.timeout,
                 approvalMode: flags['approval-mode'],
                 approvalTimeoutMs: flags['approval-timeout-ms'],

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.8"
+  "version": "1.18.10"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.8",
+  "version": "1.18.10",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {