fullcourtdefense-cli 1.3.1 → 1.3.3

package/dist/commands/mcpGateway.js

@@ -33,19 +33,44 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_GATEWAY_CLIENTS = void 0;
 exports.mcpGatewayCommand = mcpGatewayCommand;
 exports.installCursorMcpGatewayCommand = installCursorMcpGatewayCommand;
 exports.installMcpGatewayCommand = installMcpGatewayCommand;
 exports.installClaudeCodeMcpGatewayCommand = installClaudeCodeMcpGatewayCommand;
 exports.installClaudeDesktopMcpGatewayCommand = installClaudeDesktopMcpGatewayCommand;
+exports.installCodexMcpGatewayCommand = installCodexMcpGatewayCommand;
+exports.installGeminiMcpGatewayCommand = installGeminiMcpGatewayCommand;
+exports.installWindsurfMcpGatewayCommand = installWindsurfMcpGatewayCommand;
+exports.installVscodeMcpGatewayCommand = installVscodeMcpGatewayCommand;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const config_1 = require("../config");
 const discoverPaths_1 = require("./discoverPaths");
 const discover_1 = require("./discover");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
+const INSTALL_GATEWAY_ARGS = { omitSavedCredentials: true };
+exports.ALL_GATEWAY_CLIENTS = [
+    'cursor',
+    'claude-code',
+    'claude-desktop',
+    'codex',
+    'gemini-cli',
+    'windsurf',
+    'vscode',
+];
+const CLIENT_LABELS = {
+    cursor: 'Cursor',
+    'claude-code': 'Claude Code',
+    'claude-desktop': 'Claude Desktop',
+    codex: 'Codex',
+    'gemini-cli': 'Gemini CLI',
+    windsurf: 'Windsurf',
+    vscode: 'VS Code',
+};
 function parseArgsList(value) {
     if (!value?.trim())
         return [];
@@ -67,28 +92,19 @@ function parseArgsList(value) {
     }
     return trimmed.match(/(?:[^\s"]+|"[^"]*")+/g)?.map(part => part.replace(/^"|"$/g, '')) ?? [];
 }
-function loadHomeShield() {
-    try {
-        for (const name of ['.fullcourtdefense.yml', '.fullcourtdefense.yaml']) {
-            const file = path.join(os.homedir(), name);
-            if (!fs.existsSync(file))
-                continue;
-            const text = fs.readFileSync(file, 'utf8');
-            const pick = (key) => {
-                const match = text.match(new RegExp(`^\\s*${key}\\s*:\\s*(.+)\\s*$`, 'm'));
-                return match?.[1]?.replace(/^["']|["']$/g, '').trim() || undefined;
-            };
-            return { shieldId: pick('shieldId'), shieldKey: pick('shieldKey'), apiUrl: pick('apiUrl') };
-        }
-    }
-    catch {
-        // Ignore config read errors; command-line flags/env can still provide config.
-    }
-    return {};
-}
 function normalizeAgentClient(value, fallback) {
-    if (value === 'cursor' || value === 'claude-code' || value === 'claude-desktop')
-        return value;
+    const map = {
+        cursor: 'cursor',
+        'claude-code': 'claude-code',
+        'claude-desktop': 'claude-desktop',
+        codex: 'codex',
+        'gemini-cli': 'gemini-cli',
+        gemini: 'gemini-cli',
+        windsurf: 'windsurf',
+        vscode: 'vscode',
+    };
+    if (value && map[value])
+        return map[value];
     return fallback;
 }
 /**
@@ -140,16 +156,20 @@ function defaultAgentName(agentClient, developerName, defaults) {
     return `${safeIdentityPart(developerName)}-${prefix}`;
 }
 function resolveGatewayConfig(args, config, defaults = {}) {
-    const home = loadHomeShield();
-    const shieldId = args.shieldId || process.env.FCD_SHIELD_ID || process.env.FULLCOURTDEFENSE_SHIELD_ID || process.env.AGENTGUARD_SHIELD_ID || config.shieldId || home.shieldId;
-    if (!shieldId)
-        throw new Error('Missing Shield ID. Pass --shield-id or run fullcourtdefense configure.');
+    const creds = (0, config_1.resolveCliCredentials)(config, {
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    });
+    if (!creds.shieldId) {
+        throw new Error('Missing Shield ID. Run `fullcourtdefense setup` once (saves org, API key, Shield ID, and Shield key to ~/.fullcourtdefense.yml).');
+    }
     const agentClient = normalizeAgentClient(args.agentClient || process.env.FCD_AGENT_CLIENT || detectRuntimeAgentClient(), defaults.agentClient || 'cursor');
     const developerName = detectedDeveloperName(args);
     return {
-        shieldId,
-        shieldKey: args.shieldKey || process.env.FCD_SHIELD_KEY || process.env.FULLCOURTDEFENSE_SHIELD_KEY || process.env.AGENTGUARD_SHIELD_KEY || config.shieldKey || home.shieldKey,
-        apiUrl: (args.apiUrl || process.env.FCD_API_URL || process.env.FULLCOURTDEFENSE_API_URL || config.apiUrl || home.apiUrl || DEFAULT_API_URL).replace(/\/$/, ''),
+        shieldId: creds.shieldId,
+        shieldKey: creds.shieldKey,
+        apiUrl: creds.apiUrl,
         agentName: args.agentName || process.env.FCD_AGENT_NAME || defaultAgentName(agentClient, developerName, defaults),
         agentClient,
         developerName,
@@ -648,7 +668,6 @@ function buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArg
         '--agent-name', gatewayConfig.agentName,
         '--agent-client', gatewayConfig.agentClient,
         '--developer-name', gatewayConfig.developerName,
-        '--shield-id', gatewayConfig.shieldId,
         '--user-objective', gatewayConfig.userObjective || 'Developer requested this MCP action.',
         '--authority', gatewayConfig.authority || 'developer',
         '--approval-mode', gatewayConfig.approvalMode,
@@ -657,10 +676,14 @@ function buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArg
         '--scan-response', String(gatewayConfig.scanResponse),
         '--fail-closed', String(gatewayConfig.failClosed),
     ];
-    if (gatewayConfig.shieldKey && options.includeShieldKey !== false)
-        commandArgs.push('--shield-key', gatewayConfig.shieldKey);
-    if (gatewayConfig.apiUrl)
-        commandArgs.push('--api-url', gatewayConfig.apiUrl);
+    if (!options.omitSavedCredentials) {
+        commandArgs.push('--shield-id', gatewayConfig.shieldId);
+        if (gatewayConfig.shieldKey && options.includeShieldKey !== false) {
+            commandArgs.push('--shield-key', gatewayConfig.shieldKey);
+        }
+        if (gatewayConfig.apiUrl)
+            commandArgs.push('--api-url', gatewayConfig.apiUrl);
+    }
     if (gatewayConfig.environment)
         commandArgs.push('--environment', gatewayConfig.environment);
     return commandArgs;
@@ -674,6 +697,86 @@ function writeMcpServerConfig(file, serverName, nodeExe, commandArgs) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
 }
+function readJsonObject(file) {
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeJsonMcpServer(file, serverName, nodeExe, commandArgs) {
+    const json = readJsonObject(file);
+    if (!json.mcpServers || typeof json.mcpServers !== 'object')
+        json.mcpServers = {};
+    json.mcpServers[serverName] = { command: nodeExe, args: commandArgs };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
+}
+function removeTomlSection(content, tableName) {
+    const lines = content.split(/\r?\n/);
+    const out = [];
+    let skipping = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (/^\[/.test(trimmed)) {
+            skipping = trimmed === `[${tableName}]` || trimmed.startsWith(`[${tableName}.`);
+            if (!skipping)
+                out.push(line);
+            continue;
+        }
+        if (!skipping)
+            out.push(line);
+    }
+    return out.join('\n').replace(/\n{3,}/g, '\n\n').trim();
+}
+function writeCodexMcpServer(configPath, serverName, nodeExe, commandArgs) {
+    const existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : '';
+    const cleaned = removeTomlSection(existing, `mcp_servers.${serverName}`);
+    const argsToml = commandArgs.map(arg => JSON.stringify(arg)).join(', ');
+    const block = [
+        `[mcp_servers.${serverName}]`,
+        `command = ${JSON.stringify(nodeExe)}`,
+        `args = [${argsToml}]`,
+    ].join('\n');
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, `${cleaned ? `${cleaned}\n\n` : ''}${block}\n`, 'utf8');
+}
+function codexConfigPath(projectScope) {
+    return projectScope
+        ? path.join(process.cwd(), '.codex', 'config.toml')
+        : path.join(os.homedir(), '.codex', 'config.toml');
+}
+function geminiSettingsPath(projectScope) {
+    const xdg = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    return projectScope
+        ? path.join(process.cwd(), '.gemini', 'settings.json')
+        : fs.existsSync(path.join(os.homedir(), '.gemini', 'settings.json'))
+            ? path.join(os.homedir(), '.gemini', 'settings.json')
+            : path.join(xdg, 'gemini', 'settings.json');
+}
+function windsurfConfigPath() {
+    return path.join(os.homedir(), '.codeium', 'windsurf', 'mcp_config.json');
+}
+function vscodeMcpPath(projectScope) {
+    return projectScope
+        ? path.join(process.cwd(), '.vscode', 'mcp.json')
+        : path.join(process.cwd(), '.vscode', 'mcp.json');
+}
+function vscodeUserSettingsPath() {
+    const home = os.homedir();
+    const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
+    const xdg = process.env.XDG_CONFIG_HOME || path.join(home, '.config');
+    const candidates = [
+        path.join(appData, 'Code', 'User', 'settings.json'),
+        path.join(home, 'Library', 'Application Support', 'Code', 'User', 'settings.json'),
+        path.join(xdg, 'Code', 'User', 'settings.json'),
+    ];
+    return candidates.find(candidate => fs.existsSync(path.dirname(candidate)));
+}
 function normalizeClaudeCodeScope(scope) {
     if (scope === 'project' || scope === 'user' || scope === 'local')
         return scope;
@@ -691,14 +794,21 @@ function parseClientList(value) {
         'claude-desktop': 'claude-desktop',
         claude_desktop: 'claude-desktop',
         desktop: 'claude-desktop',
+        codex: 'codex',
+        'gemini-cli': 'gemini-cli',
+        gemini: 'gemini-cli',
+        windsurf: 'windsurf',
+        vscode: 'vscode',
+        'vs-code': 'vscode',
     };
     const requested = raw === 'all'
-        ? ['cursor', 'claude-code', 'claude-desktop']
+        ? exports.ALL_GATEWAY_CLIENTS.slice()
         : raw.split(',').map(part => part.trim()).filter(Boolean);
     const clients = requested.map(client => aliases[client]);
-    const unknown = requested.filter((_, index) => !clients[index]);
-    if (unknown.length > 0)
-        throw new Error(`Unknown client(s): ${unknown.join(', ')}. Use auto, all, cursor, claude-code, claude-desktop.`);
+    const unknown = requested.filter((part, index) => !clients[index]);
+    if (unknown.length > 0) {
+        throw new Error(`Unknown client(s): ${unknown.join(', ')}. Use all, auto, or: ${exports.ALL_GATEWAY_CLIENTS.join(', ')}.`);
+    }
     return Array.from(new Set(clients));
 }
 function commandAvailable(command) {
@@ -709,8 +819,9 @@ function commandAvailable(command) {
     return result.status === 0;
 }
 function detectInstallClients(cursorProject) {
+    const home = os.homedir();
     const clients = [];
-    const cursorGlobal = path.join(os.homedir(), '.cursor');
+    const cursorGlobal = path.join(home, '.cursor');
     const cursorProjectDir = path.join(process.cwd(), '.cursor');
     if (fs.existsSync(cursorGlobal) || fs.existsSync(cursorProjectDir) || cursorProject)
         clients.push('cursor');
@@ -718,6 +829,14 @@ function detectInstallClients(cursorProject) {
         clients.push('claude-code');
     if ((0, discoverPaths_1.claudeDesktopLikelyInstalled)())
         clients.push('claude-desktop');
+    if (fs.existsSync(path.join(home, '.codex')) || commandAvailable('codex'))
+        clients.push('codex');
+    if (fs.existsSync(path.join(home, '.gemini')) || commandAvailable('gemini'))
+        clients.push('gemini-cli');
+    if (fs.existsSync(windsurfConfigPath()))
+        clients.push('windsurf');
+    if (fs.existsSync(path.join(process.cwd(), '.vscode')) || vscodeUserSettingsPath())
+        clients.push('vscode');
     return clients;
 }
 function clientInstallArgs(args) {
@@ -754,7 +873,7 @@ async function installCursorMcpGatewayCommand(args, config) {
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
     const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
-    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
     writeMcpServerConfig(file, serverName, nodeExe, commandArgs);
     console.log(`AgentGuard MCP Gateway installed for Cursor (${projectScope ? 'project' : 'global'}).`);
     console.log(`Config: ${file}`);
@@ -763,57 +882,56 @@ async function installCursorMcpGatewayCommand(args, config) {
     console.log('Restart Cursor or reload MCP servers to use the protected tools.');
 }
 async function installMcpGatewayCommand(args, config) {
+    (0, config_1.requireCliSetup)(config, {
+        apiKey: args.apiKey,
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    }, { requireOrganizationId: false });
     const cursorProject = args.cursorProject === 'true';
     const selection = parseClientList(args.clients);
     const clients = selection === 'auto'
         ? detectInstallClients(cursorProject)
         : selection;
     if (clients.length === 0) {
-        throw new Error('No supported MCP clients detected. Re-run with --clients all or a comma list such as cursor,claude-desktop.');
+        throw new Error('No supported MCP clients detected. Run `fullcourtdefense install-all --clients all` or pick clients: '
+            + exports.ALL_GATEWAY_CLIENTS.join(', '));
     }
-    const baseArgs = clientInstallArgs(args);
     const successes = [];
     const failures = [];
+    console.log(`Installing MCP gateway for: ${clients.map(c => CLIENT_LABELS[c]).join(', ')}\n`);
     for (const client of clients) {
         try {
-            if (client === 'cursor') {
-                await installCursorMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName: args.serverName }, config);
-            }
-            else if (client === 'claude-code') {
-                await installClaudeCodeMcpGatewayCommand({ ...baseArgs, scope: args.claudeCodeScope, serverName: args.serverName }, config);
-            }
-            else {
-                await installClaudeDesktopMcpGatewayCommand({ ...baseArgs, serverName: args.serverName }, config);
-            }
-            successes.push(client);
+            await installGatewayClient(client, args, config, cursorProject);
+            successes.push(CLIENT_LABELS[client]);
         }
         catch (error) {
-            failures.push(`${client}: ${error instanceof Error ? error.message : String(error)}`);
+            failures.push(`${CLIENT_LABELS[client]}: ${error instanceof Error ? error.message : String(error)}`);
         }
+        if (clients.length > 1)
+            console.log('');
     }
-    console.log('');
-    console.log('AgentGuard one-install summary:');
-    console.log(`Installed: ${successes.length > 0 ? successes.join(', ') : 'none'}`);
+    console.log('AgentGuard gateway install summary:');
+    console.log(`  ✓ ${successes.length > 0 ? successes.join(', ') : 'none'}`);
     if (failures.length > 0) {
-        console.log('Failed:');
+        console.log('  ✗ Failed:');
         for (const failure of failures)
-            console.log(`- ${failure}`);
+            console.log(`    - ${failure}`);
     }
-    console.log(`Runtime identity: ${detectedDeveloperName(args)}`);
-    console.log('Restart/reload each client to use the protected tools.');
-    console.log('Smoke test prompt: "Use lookup_customer to look up customer C-1001."');
+    console.log(`  Runtime identity: ${detectedDeveloperName(args)}`);
+    console.log('Restart/reload each client to use protected MCP tools.');
     if (args.upload === 'true') {
-        console.log('');
-        console.log('Uploading desktop inventory to AI Inventory…');
+        console.log('\nUploading desktop inventory to AI Fleet…');
+        const creds = (0, config_1.resolveCliCredentials)(config, { apiKey: args.apiKey, apiUrl: args.apiUrl });
         await (0, discover_1.runDiscoverUpload)({
-            apiKey: args.apiKey || config.apiKey,
-            apiUrl: args.apiUrl,
+            apiKey: creds.apiKey,
+            apiUrl: creds.apiUrl,
             userEmail: args.developerName,
             silent: false,
         }, config);
     }
     else {
-        console.log('Run with --upload to refresh AI Inventory / Desktop MCP coverage in the app.');
+        console.log('Add --upload to refresh AI Fleet after install.');
     }
 }
 async function installClaudeCodeMcpGatewayCommand(args, config) {
@@ -830,7 +948,10 @@ async function installClaudeCodeMcpGatewayCommand(args, config) {
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
     const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
     const includeShieldKey = scope !== 'project' || Boolean(args.shieldKey);
-    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, { includeShieldKey });
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, {
+        ...INSTALL_GATEWAY_ARGS,
+        includeShieldKey,
+    });
     const claudeArgs = ['mcp', 'add', '--scope', scope, '--transport', 'stdio', serverName, '--', nodeExe, ...commandArgs];
     let result = (0, child_process_1.spawnSync)('claude', claudeArgs, {
         stdio: 'inherit',
@@ -886,7 +1007,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
     if (!downstreamCommand)
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
     const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
-    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
     for (const target of targets) {
         writeMcpServerConfig(target.file, serverName, nodeExe, commandArgs);
     }
@@ -898,3 +1019,128 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
     console.log(`Downstream: ${downstreamCommand} ${downstreamArgs.join(' ')}`);
     console.log('Restart Claude Desktop to load the protected tools.');
 }
+async function installCodexMcpGatewayCommand(args, config) {
+    const gatewayConfig = resolveGatewayConfig(args, config, {
+        agentClient: 'codex',
+        agentNamePrefix: 'codex',
+        userObjective: 'Developer requested this action from Codex.',
+    });
+    const projectScope = args.project === 'true';
+    const file = codexConfigPath(projectScope);
+    const nodeExe = process.execPath;
+    const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
+    if (!downstreamCommand)
+        throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
+    const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
+    writeCodexMcpServer(file, serverName, nodeExe, commandArgs);
+    console.log(`AgentGuard MCP Gateway installed for Codex (${projectScope ? 'project' : 'global'}).`);
+    console.log(`Config: ${file}`);
+    console.log(`Server: ${serverName}`);
+    console.log('Restart Codex or reload MCP servers. Project config requires a trusted project.');
+}
+async function installGeminiMcpGatewayCommand(args, config) {
+    const gatewayConfig = resolveGatewayConfig(args, config, {
+        agentClient: 'gemini-cli',
+        agentNamePrefix: 'gemini',
+        userObjective: 'Developer requested this action from Gemini CLI.',
+    });
+    const projectScope = args.project === 'true';
+    const file = geminiSettingsPath(projectScope);
+    const nodeExe = process.execPath;
+    const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
+    if (!downstreamCommand)
+        throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
+    const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
+    writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
+    console.log(`AgentGuard MCP Gateway installed for Gemini CLI (${projectScope ? 'project' : 'user'}).`);
+    console.log(`Config: ${file}`);
+    console.log(`Server: ${serverName}`);
+    console.log('Restart Gemini CLI to load the protected tools.');
+}
+async function installWindsurfMcpGatewayCommand(args, config) {
+    const gatewayConfig = resolveGatewayConfig(args, config, {
+        agentClient: 'windsurf',
+        agentNamePrefix: 'windsurf',
+        userObjective: 'Developer requested this action from Windsurf.',
+    });
+    const file = windsurfConfigPath();
+    const nodeExe = process.execPath;
+    const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
+    if (!downstreamCommand)
+        throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
+    const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
+    writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
+    console.log('AgentGuard MCP Gateway installed for Windsurf.');
+    console.log(`Config: ${file}`);
+    console.log(`Server: ${serverName}`);
+    console.log('Restart Windsurf to load the protected tools.');
+}
+async function installVscodeMcpGatewayCommand(args, config) {
+    const gatewayConfig = resolveGatewayConfig(args, config, {
+        agentClient: 'vscode',
+        agentNamePrefix: 'vscode',
+        userObjective: 'Developer requested this action from VS Code.',
+    });
+    const projectScope = args.project !== 'false';
+    const nodeExe = process.execPath;
+    const serverName = args.serverName || MANAGED_SERVER_NAME;
+    const downstreamCommand = args.mcpCommand || process.env.FCD_MCP_COMMAND;
+    if (!downstreamCommand)
+        throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
+    const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
+    const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
+    const targets = [];
+    if (projectScope)
+        targets.push(vscodeMcpPath(true));
+    const userSettings = vscodeUserSettingsPath();
+    if (userSettings)
+        targets.push(userSettings);
+    if (targets.length === 0)
+        targets.push(vscodeMcpPath(true));
+    for (const file of targets) {
+        if (file.endsWith('settings.json'))
+            writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
+        else
+            writeMcpServerConfig(file, serverName, nodeExe, commandArgs);
+    }
+    console.log('AgentGuard MCP Gateway installed for VS Code.');
+    for (const file of targets)
+        console.log(`Config: ${file}`);
+    console.log(`Server: ${serverName}`);
+    console.log('Reload VS Code window or restart to pick up MCP changes.');
+}
+async function installGatewayClient(client, args, config, cursorProject) {
+    const baseArgs = clientInstallArgs(args);
+    const serverName = args.serverName;
+    switch (client) {
+        case 'cursor':
+            await installCursorMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName }, config);
+            break;
+        case 'claude-code':
+            await installClaudeCodeMcpGatewayCommand({ ...baseArgs, scope: args.claudeCodeScope, serverName }, config);
+            break;
+        case 'claude-desktop':
+            await installClaudeDesktopMcpGatewayCommand({ ...baseArgs, serverName }, config);
+            break;
+        case 'codex':
+            await installCodexMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName }, config);
+            break;
+        case 'gemini-cli':
+            await installGeminiMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName }, config);
+            break;
+        case 'windsurf':
+            await installWindsurfMcpGatewayCommand({ ...baseArgs, serverName }, config);
+            break;
+        case 'vscode':
+            await installVscodeMcpGatewayCommand({ ...baseArgs, project: String(cursorProject), serverName }, config);
+            break;
+        default:
+            throw new Error(`Unsupported client: ${client}`);
+    }
+}

package/dist/config.d.ts

@@ -1,5 +1,6 @@
 export interface BotGuardConfig {
     apiKey?: string;
+    organizationId?: string;
     apiUrl?: string;
     shieldId?: string;
     shieldKey?: string;
@@ -15,6 +16,7 @@ export interface BotGuardConfig {
         webhookFormat?: string;
     };
 }
+export declare function getHomeConfigPath(): string;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
 export declare function saveShieldConfig(input: {
@@ -22,4 +24,28 @@ export declare function saveShieldConfig(input: {
     shieldKey?: string;
     apiUrl?: string;
 }): string;
+export interface SetupConfigInput {
+    apiKey?: string;
+    organizationId?: string;
+    apiUrl?: string;
+    shieldId?: string;
+    shieldKey?: string;
+}
+export interface ResolvedCliCredentials {
+    apiKey?: string;
+    organizationId?: string;
+    apiUrl: string;
+    shieldId?: string;
+    shieldKey?: string;
+}
+/** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
+export declare function resolveCliCredentials(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>): ResolvedCliCredentials;
+export declare function isCliSetupComplete(config: BotGuardConfig): boolean;
+/** Fail fast with a clear message when setup was not run. */
+export declare function requireCliSetup(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {
+    requireApiKey?: boolean;
+    requireOrganizationId?: boolean;
+    requireShield?: boolean;
+}): ResolvedCliCredentials;
+export declare function saveSetupConfig(input: SetupConfigInput, targetPath?: string): string;
 export declare function resolveSystemPrompt(value: string): string;