fullcourtdefense-cli 1.3.3 → 1.3.5

package/dist/commands/configure.d.ts

@@ -6,5 +6,7 @@ export interface ConfigureArgs {
     shieldKey?: string;
     apiUrl?: string;
     skipValidate?: boolean;
+    /** When true, use only flags/env/config — no prompts (for scripts). */
+    nonInteractive?: boolean;
 }
 export declare function configureCommand(args: ConfigureArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/configure.js

@@ -43,63 +43,107 @@ async function ask(rl, question, fallback) {
     const answer = (await rl.question(`${question}${suffix}: `)).trim();
     return answer || fallback || '';
 }
+async function confirm(rl, question, defaultYes = true) {
+    const hint = defaultYes ? 'Y/n' : 'y/N';
+    const answer = (await rl.question(`${question} (${hint}): `)).trim().toLowerCase();
+    if (!answer)
+        return defaultYes;
+    return answer === 'y' || answer === 'yes';
+}
 function resolveApiKey(args, config) {
     return args.apiKey || config.apiKey || process.env.FULLCOURTDEFENSE_API_KEY || '';
 }
+function defaultsFrom(args, config) {
+    return {
+        apiUrl: args.apiUrl || config.apiUrl || 'https://api.fullcourtdefense.ai',
+        apiKey: resolveApiKey(args, config),
+        organizationId: args.organizationId || config.organizationId || '',
+        shieldId: args.shieldId || config.shieldId || '',
+        shieldKey: args.shieldKey ?? config.shieldKey ?? '',
+    };
+}
+function allFlagsProvided(args) {
+    return Boolean(args.apiKey && args.organizationId && args.shieldId && args.apiUrl);
+}
+function isValidationUnavailableError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes('HTML instead of JSON') || message.includes('404');
+}
 async function configureCommand(args, config) {
-    const apiUrl = args.apiUrl || config.apiUrl || 'https://api.fullcourtdefense.ai';
-    const apiKey = resolveApiKey(args, config);
-    const organizationId = args.organizationId || config.organizationId;
-    const shieldId = args.shieldId || config.shieldId;
-    const shieldKey = args.shieldKey ?? config.shieldKey;
-    const hasAllRequired = Boolean(apiKey && organizationId && shieldId);
-    let finalApiUrl = apiUrl;
-    let finalApiKey = apiKey;
-    let finalOrgId = organizationId;
-    let finalShieldId = shieldId;
-    let finalShieldKey = shieldKey;
-    if (!hasAllRequired) {
-        const rl = readline.createInterface({ input: process_1.stdin, output: process_1.stdout });
-        try {
-            finalApiUrl = args.apiUrl || await ask(rl, 'FullCourtDefense API URL', config.apiUrl || 'https://api.fullcourtdefense.ai');
-            finalApiKey = resolveApiKey(args, config) || await ask(rl, 'Organization API key (from Settings → API Keys)', '');
-            finalOrgId = args.organizationId || await ask(rl, 'Organization ID (from Settings → Organization)', config.organizationId || '');
-            finalShieldId = args.shieldId || await ask(rl, 'Shield ID', config.shieldId || 'sh_...');
-            finalShieldKey = args.shieldKey ?? await ask(rl, 'Shield key if locked, blank if not required', config.shieldKey || '');
+    const saved = defaultsFrom(args, config);
+    const useWizard = !args.nonInteractive && !allFlagsProvided(args);
+    let finalApiUrl = saved.apiUrl;
+    let finalApiKey = saved.apiKey;
+    let finalOrgId = saved.organizationId;
+    let finalShieldId = saved.shieldId;
+    let finalShieldKey = saved.shieldKey;
+    const rl = useWizard ? readline.createInterface({ input: process_1.stdin, output: process_1.stdout }) : null;
+    try {
+        if (useWizard && rl) {
+            console.log('');
+            console.log('FullCourtDefense setup — enter each value one at a time.');
+            console.log('Press Enter to keep the default shown in parentheses.');
+            console.log('Find these in the app: Settings → API Keys / Organization, Shield → Integrate.\n');
+            finalApiUrl = await ask(rl, '1/5 API URL', saved.apiUrl);
+            finalApiKey = await ask(rl, '2/5 Organization API key', saved.apiKey || undefined);
+            finalOrgId = await ask(rl, '3/5 Organization ID', saved.organizationId || undefined);
+            finalShieldId = await ask(rl, '4/5 Shield ID (sh_...)', saved.shieldId || undefined);
+            finalShieldKey = await ask(rl, '5/5 Shield key (blank if not required)', saved.shieldKey || undefined);
+            console.log('');
         }
-        finally {
-            rl.close();
+        if (!finalApiKey) {
+            throw new Error('Organization API key is required.');
         }
-    }
-    if (!finalApiKey) {
-        throw new Error('Organization API key is required to validate your setup.');
-    }
-    if (!finalOrgId) {
-        throw new Error('Organization ID is required.');
-    }
-    if (!finalShieldId || finalShieldId === 'sh_...') {
-        throw new Error('Shield ID is required.');
-    }
-    if (args.skipValidate !== true) {
-        console.log('Validating organization, Shield ID, and Shield key against FullCourtDefense...');
-        const api = new api_1.BotGuardApi(finalApiKey, finalApiUrl);
-        const validated = await api.validateSetup({
+        if (!finalOrgId) {
+            throw new Error('Organization ID is required.');
+        }
+        if (!finalShieldId || finalShieldId === 'sh_...') {
+            throw new Error('Shield ID is required.');
+        }
+        let skipValidate = args.skipValidate === true;
+        if (!skipValidate) {
+            console.log('Validating organization, Shield ID, and Shield key against FullCourtDefense...');
+            const api = new api_1.BotGuardApi(finalApiKey, finalApiUrl);
+            try {
+                const validated = await api.validateSetup({
+                    organizationId: finalOrgId,
+                    shieldId: finalShieldId,
+                    shieldKey: finalShieldKey || undefined,
+                });
+                if (validated.organizationId !== finalOrgId) {
+                    throw new Error(`Organization mismatch: API key belongs to "${validated.organizationName}" (${validated.organizationId}), not "${finalOrgId}".`);
+                }
+                console.log(`Verified: ${validated.organizationName} → Shield "${validated.shieldName}" (${validated.shieldId})`);
+            }
+            catch (error) {
+                if (isValidationUnavailableError(error)) {
+                    console.log('Server validation is not available yet (API endpoint not deployed).');
+                    if (useWizard && rl) {
+                        skipValidate = await confirm(rl, 'Save credentials locally anyway?', true);
+                        if (!skipValidate)
+                            throw error;
+                    }
+                    else {
+                        throw new Error(`${error instanceof Error ? error.message : String(error)} `
+                            + 'Use `fullcourtdefense setup --skip-validate true` or run interactive `fullcourtdefense setup` to save without validation.');
+                    }
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        const savedPath = (0, config_1.saveSetupConfig)({
+            apiKey: finalApiKey,
             organizationId: finalOrgId,
             shieldId: finalShieldId,
             shieldKey: finalShieldKey || undefined,
+            apiUrl: finalApiUrl,
         });
-        if (validated.organizationId !== finalOrgId) {
-            throw new Error(`Organization mismatch: API key belongs to "${validated.organizationName}" (${validated.organizationId}), not "${finalOrgId}".`);
-        }
-        console.log(`Verified: ${validated.organizationName} → Shield "${validated.shieldName}" (${validated.shieldId})`);
+        console.log(`Saved setup to ${savedPath}`);
+        console.log('All other CLI commands (install, discover --upload, scan, hooks) will use these credentials automatically.');
+    }
+    finally {
+        rl?.close();
     }
-    const savedPath = (0, config_1.saveSetupConfig)({
-        apiKey: finalApiKey,
-        organizationId: finalOrgId,
-        shieldId: finalShieldId,
-        shieldKey: finalShieldKey || undefined,
-        apiUrl: finalApiUrl,
-    });
-    console.log(`Saved setup to ${savedPath}`);
-    console.log('All other CLI commands (install, discover --upload, scan, hooks) will use these credentials automatically.');
 }

package/dist/commands/mcpGateway.d.ts

@@ -5,6 +5,8 @@ export declare const ALL_GATEWAY_CLIENTS: GatewayClient[];
 export interface McpGatewayArgs {
     mcpCommand?: string;
     mcpArgs?: string;
+    /** Working directory for the downstream MCP process (Codex config.toml cwd). */
+    mcpCwd?: string;
     agentName?: string;
     agentClient?: string;
     developerName?: string;

package/dist/commands/mcpGateway.js

@@ -733,18 +733,42 @@ function removeTomlSection(content, tableName) {
     }
     return out.join('\n').replace(/\n{3,}/g, '\n\n').trim();
 }
-function writeCodexMcpServer(configPath, serverName, nodeExe, commandArgs) {
+function writeCodexMcpServer(configPath, serverName, nodeExe, commandArgs, options = {}) {
     const existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : '';
     const cleaned = removeTomlSection(existing, `mcp_servers.${serverName}`);
     const argsToml = commandArgs.map(arg => JSON.stringify(arg)).join(', ');
-    const block = [
+    const blockLines = [
         `[mcp_servers.${serverName}]`,
         `command = ${JSON.stringify(nodeExe)}`,
         `args = [${argsToml}]`,
-    ].join('\n');
+    ];
+    if (options.cwd) {
+        blockLines.push(`cwd = ${JSON.stringify(options.cwd.replace(/\//g, path.sep))}`);
+    }
+    if (options.startupTimeoutSec && options.startupTimeoutSec > 0) {
+        blockLines.push(`startup_timeout_sec = ${options.startupTimeoutSec}`);
+    }
+    const block = blockLines.join('\n');
     fs.mkdirSync(path.dirname(configPath), { recursive: true });
     fs.writeFileSync(configPath, `${cleaned ? `${cleaned}\n\n` : ''}${block}\n`, 'utf8');
 }
+function resolveMcpCwd(args) {
+    const explicit = args.mcpCwd || process.env.FCD_MCP_CWD;
+    if (explicit)
+        return path.resolve(explicit);
+    const pkg = path.join(process.cwd(), 'package.json');
+    if (fs.existsSync(pkg)) {
+        try {
+            const scripts = JSON.parse(fs.readFileSync(pkg, 'utf8')).scripts || {};
+            const mcpArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
+            if (args.mcpCommand === 'npm' && mcpArgs[0] === 'run' && scripts[mcpArgs[1] || 'mcp']) {
+                return process.cwd();
+            }
+        }
+        catch { /* ignore */ }
+    }
+    return undefined;
+}
 function codexConfigPath(projectScope) {
     return projectScope
         ? path.join(process.cwd(), '.codex', 'config.toml')
@@ -1034,7 +1058,10 @@ async function installCodexMcpGatewayCommand(args, config) {
         throw new Error('Pass --mcp-command for the real MCP server you want to protect.');
     const downstreamArgs = parseArgsList(args.mcpArgs || process.env.FCD_MCP_ARGS);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
-    writeCodexMcpServer(file, serverName, nodeExe, commandArgs);
+    writeCodexMcpServer(file, serverName, nodeExe, commandArgs, {
+        cwd: resolveMcpCwd(args),
+        startupTimeoutSec: 120,
+    });
     console.log(`AgentGuard MCP Gateway installed for Codex (${projectScope ? 'project' : 'global'}).`);
     console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);

package/dist/index.js

@@ -111,7 +111,7 @@ function printHelp() {
     doctor      First step. Checks outbound HTTPS access to FullCourtDefense.
     configure   Saves org API key, Organization ID, Shield ID, and Shield key to ~/.fullcourtdefense.yml.
                 After setup, other commands read credentials automatically — no --shield-id/--api-key needed.
-    setup       Same as configure — validates credentials against the server before saving.
+    setup       Same as configure — step-by-step wizard; validates before saving.
     install-all One-click: MCP gateway in every AI client + Cursor hooks + optional upload.
     install     Alias for install-all.
     scan        Runs the scan. Use --local for inside-organization scans.
@@ -154,9 +154,8 @@ function printHelp() {
        fullcourtdefense doctor
        This confirms the machine can reach https://api.fullcourtdefense.ai over HTTPS.
 
-    3. Save org + Shield credentials locally (one time):
+    3. Save org + Shield credentials locally (one time, prompts one field at a time):
        fullcourtdefense setup
-       Saves to ~/.fullcourtdefense.yml — install, discover --upload, scan, and hooks use it automatically.
 
     4. One-click protect every AI client on this machine:
        fullcourtdefense install-all --mcp-command npm --mcp-args "run mcp" --upload
@@ -296,6 +295,7 @@ async function main() {
         serverName: flags['server-name'],
         mcpCommand: flags['mcp-command'],
         mcpArgs: flags['mcp-args'],
+        mcpCwd: flags['mcp-cwd'],
         agentName: flags['agent-name'],
         developerName: flags['developer-name'],
         shieldId: flags['shield-id'],
@@ -315,6 +315,7 @@ async function main() {
     const buildGatewayArgs = () => ({
         mcpCommand: flags['mcp-command'],
         mcpArgs: flags['mcp-args'],
+        mcpCwd: flags['mcp-cwd'],
         agentName: flags['agent-name'],
         agentClient: flags['agent-client'],
         developerName: flags['developer-name'],
@@ -409,6 +410,7 @@ async function main() {
                 shieldKey: flags['shield-key'],
                 apiUrl: flags['api-url'],
                 skipValidate: flags['skip-validate'] === 'true',
+                nonInteractive: flags['non-interactive'] === 'true',
             };
             await (0, configure_1.configureCommand)(args, config);
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.3.3"
+  "version": "1.3.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {