fullcourtdefense-cli 1.21.0 → 1.21.2

package/dist/commands/hook.js

@@ -593,10 +593,18 @@ async function hookCommand(args, config) {
                 decision.agent_message = agentMsg;
         }
         dbg({ phase: 'verdict', event, format: hookFormat, blocked, decision });
+        if (hookFormat === 'claude' && event === 'prompt' && blocked) {
+            // Claude Desktop/Code variants do not all honor the structured
+            // UserPromptSubmit decision consistently. Exit 2 is the documented hard
+            // block contract: stderr is shown as the rejection reason and the prompt
+            // is not sent to the model.
+            process.stderr.write(userMsg || agentMsg || 'Blocked by FullCourtDefense.');
+            process.exit(2);
+        }
         process.stdout.write(JSON.stringify(decision));
-        // ALWAYS exit 0 so the client uses our JSON verdict. Exit 2 is interpreted as
-        // `permission: "deny"`, which beforeSubmitPrompt ignores (it uses `continue`),
-        // so exiting 2 would silently let blocked prompts through.
+        // Cursor must exit 0 so it consumes the JSON verdict. In particular,
+        // beforeSubmitPrompt ignores an exit-2 permission denial and uses
+        // `{ continue: false }`.
         process.exit(0);
     };
     // Claude-format lifecycle events with no pre-execution surface (PostToolUse,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.0"
+  "version": "1.21.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.0",
+  "version": "1.21.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {