fullcourtdefense-cli 1.3.6 → 1.4.0

package/dist/commands/configure.js

@@ -53,7 +53,7 @@ function looksLikeShieldKey(value) {
     return /^shsk_[A-Za-z0-9]{24,160}$/.test(value);
 }
 function looksLikeApiKey(value) {
-    return /^ag_[A-Za-z0-9]{24,160}$/.test(value);
+    return /^ag_[A-Za-z0-9_-]{24,200}$/.test(value);
 }
 function validateLocalShape(input) {
     const problems = [];

package/dist/commands/hook.d.ts

@@ -3,12 +3,21 @@ import { BotGuardConfig } from '../config';
  * `fullcourtdefense hook` — Cursor hook bridge.
  *
  * Cursor invokes this command for agent lifecycle events (beforeSubmitPrompt,
- * beforeShellExecution, beforeMCPExecution, afterFileEdit, ...). Cursor pipes a
- * JSON payload on stdin and reads a JSON verdict on stdout. Exit code 2 also
- * blocks the action, which we use as the cross-event, cross-version-safe block
- * signal (not every event documents a `permission` output field).
+ * beforeShellExecution, beforeMCPExecution, afterFileEdit, beforeReadFile).
+ * Cursor pipes a JSON payload on stdin and reads a JSON verdict on stdout.
  *
- * Verdict source of truth: POST {apiUrl}/api/shield/analyze/{shieldId}.
+ * Two enforcement engines, by event:
+ *   - prompt  -> Shield text analysis (POST /api/shield/proxy/{shieldId}).
+ *               Action Policies don't apply to free-form chat, so prompts are
+ *               judged by the developer-chat Shield (monitor or block per mode).
+ *   - shell / mcp / file / read -> Action Policies, the SAME engine the MCP
+ *               gateway uses (POST /api/agent-security/runtime/check-tool-call).
+ *               The org's policies attached to the runtime identity decide:
+ *               allow / block / require_approval — enforced in EVERY repo on the
+ *               machine, regardless of which folder Cursor is open in.
+ *
+ * require_approval pauses the action and polls the approval endpoint until a
+ * human approves/rejects in the FullCourtDefense console (same as the gateway).
  */
 export interface HookArgs {
     event?: string;
@@ -18,5 +27,8 @@ export interface HookArgs {
     shadow?: string;
     failClosed?: string;
     timeout?: string;
+    approvalMode?: string;
+    approvalTimeoutMs?: string;
+    approvalPollMs?: string;
 }
 export declare function hookCommand(args: HookArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/hook.js

@@ -102,48 +102,72 @@ function inferEvent(explicit, payload) {
         return 'file';
     return 'unknown';
 }
-/** Pull the meaningful text to scan out of a Cursor hook payload, per event. */
-function extractText(event, p) {
-    const str = (v) => (typeof v === 'string' ? v : '');
+const str = (v) => (typeof v === 'string' ? v : '');
+/** Pull the meaningful text to scan out of a Cursor PROMPT hook payload. */
+function extractPromptText(p) {
+    const direct = str(p.prompt) || str(p.text) || str(p.message) || str(p.content);
+    if (direct)
+        return direct;
+    const promptObj = p.prompt;
+    if (promptObj && typeof promptObj === 'object') {
+        const t = str(promptObj.text) || str(promptObj.content);
+        if (t)
+            return t;
+    }
+    const messages = p.messages;
+    if (Array.isArray(messages) && messages.length) {
+        const last = messages[messages.length - 1];
+        return str(last?.content) || str(last?.text);
+    }
+    return '';
+}
+/**
+ * Map a Cursor execution-hook payload onto an Action Policy tool call.
+ * Returns null when there is nothing actionable to evaluate.
+ */
+function buildToolCall(event, p) {
     switch (event) {
-        case 'prompt': {
-            const direct = str(p.prompt) || str(p.text) || str(p.message) || str(p.content);
-            if (direct)
-                return direct;
-            // Some shapes nest the prompt or send a messages array.
-            const promptObj = p.prompt;
-            if (promptObj && typeof promptObj === 'object') {
-                const t = str(promptObj.text) || str(promptObj.content);
-                if (t)
-                    return t;
-            }
-            const messages = p.messages;
-            if (Array.isArray(messages) && messages.length) {
-                const last = messages[messages.length - 1];
-                return str(last?.content) || str(last?.text);
-            }
-            return '';
+        case 'shell': {
+            const command = str(p.command) || str(p.cmd);
+            if (!command)
+                return null;
+            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || undefined } };
         }
-        case 'shell':
-            return str(p.command) || str(p.cmd);
         case 'mcp': {
-            const name = str(p.tool_name) || str(p.toolName) || str(p.name);
-            const input = p.tool_input ?? p.arguments ?? p.input ?? p.params;
-            const inputStr = typeof input === 'string' ? input : input ? safeJson(input) : '';
-            return [name, inputStr].filter(Boolean).join(': ');
+            const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
+            const rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
+            return { toolName, toolArgs };
         }
         case 'file': {
+            const filePath = str(p.file_path) || str(p.path);
             const edits = p.edits;
-            if (Array.isArray(edits)) {
-                return edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n');
-            }
-            return str(p.content) || str(p.new_text) || '';
+            const content = Array.isArray(edits)
+                ? edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n')
+                : (str(p.content) || str(p.new_text));
+            if (!filePath && !content)
+                return null;
+            return { toolName: 'edit_file', toolArgs: { path: filePath || undefined, content: content || undefined } };
+        }
+        case 'read': {
+            const filePath = str(p.file_path) || str(p.path);
+            if (!filePath)
+                return null;
+            return { toolName: 'read_file', toolArgs: { path: filePath } };
         }
-        case 'read':
-            return str(p.file_path) || str(p.path) || '';
         default:
-            return str(p.prompt) || str(p.text) || str(p.message) || str(p.command) || '';
+            return null;
+    }
+}
+function summarizeToolCall(toolName, toolArgs) {
+    const parts = [toolName];
+    for (const [k, v] of Object.entries(toolArgs)) {
+        if (v === undefined || v === null)
+            continue;
+        const sv = typeof v === 'string' ? v : safeJson(v);
+        parts.push(`${k}=${sv.slice(0, 200)}`);
     }
+    return parts.join(' ').slice(0, 500);
 }
 function safeJson(v) {
     try {
@@ -153,7 +177,7 @@ function safeJson(v) {
         return String(v);
     }
 }
-/** Per-event attribution that maps onto the existing Shield runtime headers. */
+/** Per-event attribution that maps onto the existing Shield runtime headers (prompt path). */
 function attributionFor(event, p) {
     const h = {};
     const set = (k, v) => { if (v)
@@ -164,33 +188,12 @@ function attributionFor(event, p) {
             set('x-runtime-event-type', 'user_message');
             set('x-runtime-trust', 'trusted_user');
             break;
-        case 'shell':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'action_request');
-            set('x-action-type', 'shell');
-            set('x-runtime-sink', 'execute');
-            set('x-runtime-trust', 'untrusted');
-            break;
-        case 'mcp':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'tool_call');
-            set('x-tool-name', String(p.tool_name || p.toolName || p.name || 'mcp'));
-            set('x-runtime-trust', 'untrusted');
-            break;
-        case 'file':
-            set('x-input-source', 'generated');
-            set('x-runtime-event-type', 'memory_write');
-            break;
-        case 'read':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'memory_read');
-            break;
         default:
             set('x-input-source', 'user');
     }
     return h;
 }
-/** Stable developer identity, used for per-developer attribution on shield events. */
+/** Stable developer identity, used for per-developer attribution. */
 function developerId() {
     if (process.env.FULLCOURTDEFENSE_DEVELOPER_ID)
         return process.env.FULLCOURTDEFENSE_DEVELOPER_ID;
@@ -209,10 +212,29 @@ function sessionId(p) {
         return fromPayload;
     return `cursor-${os.hostname()}`;
 }
+function machineMetadata() {
+    let username = 'unknown';
+    try {
+        username = os.userInfo().username;
+    }
+    catch { /* ignore */ }
+    return {
+        developerName: developerId(),
+        machineName: os.hostname(),
+        os: `${os.platform()} ${os.release()}`,
+        username,
+        cwd: process.cwd(),
+        workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
+        agentClient: 'cursor',
+    };
+}
 async function hookCommand(args, config) {
     const shadow = args.shadow === 'true';
     const failClosed = args.failClosed === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
+    const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
+    const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000;
+    const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
@@ -245,13 +267,12 @@ async function hookCommand(args, config) {
         }
     }
     const event = inferEvent(args.event, payload);
-    const text = extractText(event, payload).trim();
     dbg({ phase: 'invoke', event, argEvent: args.event, pid: process.pid,
         isTTY, rawLen: raw.length, rawPreview: raw.slice(0, 300), stdinErr, parseErr,
-        argv: process.argv.slice(2), payloadKeys: Object.keys(payload), textPreview: text.slice(0, 80) });
+        argv: process.argv.slice(2), payloadKeys: Object.keys(payload) });
     // Emit the verdict in the shape Cursor expects for THIS event, then exit.
     // beforeSubmitPrompt blocks via { continue: false }; the execution hooks
-    // (shell/mcp/read) block via { permission: "deny" }. Exit 2 reinforces it.
+    // (shell/mcp/read) block via { permission: "deny" }.
     const respond = (blocked, userMsg, agentMsg) => {
         const decision = event === 'prompt'
             ? (blocked ? { continue: false } : { continue: true })
@@ -267,18 +288,154 @@ async function hookCommand(args, config) {
         // so exiting 2 would silently let blocked prompts through.
         process.exit(0);
     };
-    // Nothing to scan, or no Shield configured → allow (fail-open by design here:
-    // a misconfigured machine must not brick the developer's IDE).
-    if (!text)
-        respond(false);
+    // No Shield configured → allow (fail-open by design: a misconfigured machine
+    // must not brick the developer's IDE).
     if (!shieldId) {
-        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense configure`).');
+        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense setup`).');
+    }
+    // --- Action Policy enforcement for actions (shell / mcp / file / read) ---
+    if (event === 'shell' || event === 'mcp' || event === 'file' || event === 'read') {
+        await enforceActionPolicy({
+            event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
+            shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond,
+        });
+        return;
+    }
+    // --- Shield text analysis for prompts (developer chat) ---
+    if (event === 'prompt') {
+        const text = extractPromptText(payload).trim();
+        if (!text)
+            respond(false);
+        await enforceShieldText({
+            event, text, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
+            shadow, failClosed, timeoutMs, respond,
+        });
+        return;
+    }
+    // Unknown event → nothing to enforce.
+    respond(false);
+}
+async function enforceActionPolicy(ctx) {
+    const { event, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
+    const call = buildToolCall(event, payload);
+    if (!call) {
+        respond(false);
+        return;
     }
+    const headers = { 'Content-Type': 'application/json' };
+    if (shieldKey)
+        headers['x-shield-key'] = shieldKey;
+    let result;
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        const resp = await fetch(`${apiUrl}/api/agent-security/runtime/check-tool-call`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                shieldId,
+                agentName: `cursor-${developerId()}`,
+                toolName: call.toolName,
+                toolArgs: call.toolArgs,
+                argsSummary: summarizeToolCall(call.toolName, call.toolArgs),
+                sessionId: sessionId(payload),
+                source: 'cursor_hook',
+                ...machineMetadata(),
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!resp.ok) {
+            dbg({ phase: 'policy_http_error', event, status: resp.status });
+            respond(failClosed, failClosed ? `FullCourtDefense policy gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense policy gate returned HTTP ${resp.status}.`);
+            return;
+        }
+        const body = await resp.json().catch(() => ({}));
+        if (!body.success || !body.data) {
+            dbg({ phase: 'policy_no_data', event, error: body.error });
+            respond(failClosed, failClosed ? 'FullCourtDefense policy gate error — blocked by fail-closed policy.' : undefined, body.error);
+            return;
+        }
+        result = body.data;
+    }
+    catch (err) {
+        dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err) });
+        respond(failClosed, failClosed ? 'FullCourtDefense policy gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        return;
+    }
+    const reason = result.actionPolicy?.reason
+        || result.intentEvaluation?.reasons?.[0]
+        || `${call.toolName} ${result.decision}ed by Action Policy.`;
+    const policyName = result.actionPolicy?.policyName;
+    dbg({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
+    if (result.allowed && result.decision === 'allow') {
+        respond(false);
+        return;
+    }
+    // require_approval — pause and wait for a human to approve in the console.
+    if (result.decision === 'approval') {
+        if (shadow) {
+            respond(false, undefined, `[FullCourtDefense shadow] would require approval for ${call.toolName}${policyName ? ` (${policyName})` : ''}: ${reason}`);
+            return;
+        }
+        if (ctx.approvalMode === 'block' || !result.approvalActionId) {
+            respond(true, `Approval required by FullCourtDefense${policyName ? ` (${policyName})` : ''} — ${reason}`, `This ${event} requires human approval per Action Policy. Stop and ask the developer to approve it in the FullCourtDefense console.`);
+            return;
+        }
+        const outcome = await waitForApproval({
+            apiUrl, shieldId, shieldKey, actionId: result.approvalActionId,
+            timeoutMs: ctx.approvalTimeoutMs, pollMs: ctx.approvalPollMs,
+        });
+        if (outcome.status === 'approved') {
+            respond(false, undefined, `FullCourtDefense: human approved this ${event}.`);
+            return;
+        }
+        respond(true, `FullCourtDefense: ${outcome.message}`, `This ${event} was not approved (${outcome.status}). Do not retry until a human approves it in the FullCourtDefense console.`);
+        return;
+    }
+    // block / mask / any other not-allowed decision.
+    if (shadow) {
+        respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}${policyName ? ` (${policyName})` : ''}: ${reason}`);
+        return;
+    }
+    respond(true, `Blocked by FullCourtDefense${policyName ? ` (${policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} per Action Policy: ${reason}. Do not retry.`);
+}
+async function waitForApproval(input) {
+    const headers = { 'Content-Type': 'application/json' };
+    if (input.shieldKey)
+        headers['x-shield-key'] = input.shieldKey;
+    const url = `${input.apiUrl}/api/agent-security/runtime/approvals/${encodeURIComponent(input.actionId)}?shieldId=${encodeURIComponent(input.shieldId)}`;
+    const deadline = Date.now() + input.timeoutMs;
+    dbg({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: input.timeoutMs });
+    while (Date.now() <= deadline) {
+        try {
+            const resp = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(15000) });
+            if (resp.ok) {
+                const body = await resp.json().catch(() => ({}));
+                const approval = body.data?.approval;
+                if (approval?.approvalStatus === 'approved') {
+                    return { status: 'approved', message: 'approved by a human reviewer.' };
+                }
+                if (approval?.approvalStatus === 'rejected') {
+                    return { status: 'rejected', message: `approval rejected for ${approval.toolName}.` };
+                }
+                if (approval?.approvalStatus === 'expired') {
+                    return { status: 'expired', message: `approval expired for ${approval.toolName}.` };
+                }
+            }
+        }
+        catch (err) {
+            dbg({ phase: 'approval_poll_error', actionId: input.actionId, error: err instanceof Error ? err.message : String(err) });
+        }
+        await new Promise((resolve) => setTimeout(resolve, Math.min(input.pollMs, Math.max(0, deadline - Date.now()))));
+    }
+    return { status: 'timeout', message: 'approval timed out — still waiting for human review.' };
+}
+async function enforceShieldText(ctx) {
+    const { event, text, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
     try {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
-        // Behaves exactly like a normal Shield agent calling the public proxy:
-        // Shield key + runtime/developer attribution headers, body { message }.
         const headers = {
             'Content-Type': 'application/json',
             'x-runtime-source-id': developerId(),
@@ -296,28 +453,21 @@ async function hookCommand(args, config) {
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            // Backend rejected (quota, bad shield, etc.) — fail open unless told otherwise.
             respond(failClosed, failClosed ? `FullCourtDefense gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense gate returned HTTP ${resp.status}.`);
         }
         const data = await resp.json().catch(() => ({}));
         const sh = (data._shield || {});
         const action = String(sh.action || '');
-        // Proxy returns 'blocked_input' / 'blocked_output' when it blocks; in monitor
-        // mode it returns 'allowed' (never block, even if wouldBlock is set).
         const isBlocked = action.startsWith('blocked');
         const reason = String(sh.reason || 'policy_violation');
         const explanation = String(sh.reason || 'Flagged by FullCourtDefense.');
-        if (!isBlocked) {
+        if (!isBlocked)
             respond(false);
-        }
-        // Blocked verdict. In shadow mode we annotate but let it through.
-        if (shadow) {
+        if (shadow)
             respond(false, undefined, `[FullCourtDefense shadow] would block ${event} (${reason}): ${explanation}`);
-        }
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
-        // Network error / timeout.
         respond(failClosed, failClosed ? 'FullCourtDefense gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
     }
 }

package/dist/commands/installCursorHook.js

@@ -47,12 +47,16 @@ const COLOR = {
 // find our entries regardless of the install path (npm global vs local dev).
 const MANAGED_MARKER = '--fcd-managed true';
 const MANAGED_TAG = 'fullcourtdefense';
+// `timeoutSec` is the Cursor-side hook timeout. Action events can pause for a
+// human approval decision, so they need a long timeout (Cursor kills the hook
+// at this limit). Allow/block verdicts still return in <1s — the long timeout
+// only matters while waiting for a human to approve in the console.
 const EVENT_MAP = {
-    prompt: { hookKey: 'beforeSubmitPrompt', flag: 'prompt', failClosedDefault: false },
-    shell: { hookKey: 'beforeShellExecution', flag: 'shell', failClosedDefault: true },
-    mcp: { hookKey: 'beforeMCPExecution', flag: 'mcp', failClosedDefault: true },
-    file: { hookKey: 'afterFileEdit', flag: 'file', failClosedDefault: false },
-    read: { hookKey: 'beforeReadFile', flag: 'read', failClosedDefault: false },
+    prompt: { hookKey: 'beforeSubmitPrompt', flag: 'prompt', failClosedDefault: false, timeoutSec: 10 },
+    shell: { hookKey: 'beforeShellExecution', flag: 'shell', failClosedDefault: true, timeoutSec: 300 },
+    mcp: { hookKey: 'beforeMCPExecution', flag: 'mcp', failClosedDefault: true, timeoutSec: 300 },
+    file: { hookKey: 'afterFileEdit', flag: 'file', failClosedDefault: false, timeoutSec: 300 },
+    read: { hookKey: 'beforeReadFile', flag: 'read', failClosedDefault: false, timeoutSec: 300 },
 };
 /** Build the absolute, shell-agnostic command that invokes this CLI's `hook`. */
 function buildHookCommand(flag, opts) {
@@ -120,11 +124,11 @@ async function installCursorHookCommand(args, config) {
     const credFile = ensureHomeShield(creds);
     const json = readHooksJson(file);
     for (const e of events) {
-        const { hookKey, flag, failClosedDefault } = EVENT_MAP[e];
+        const { hookKey, flag, failClosedDefault, timeoutSec } = EVENT_MAP[e];
         const failClosed = args.failClosed !== undefined ? args.failClosed === 'true' : failClosedDefault;
         const entry = {
             command: buildHookCommand(flag, { shadow, failClosed }),
-            timeout: 10,
+            timeout: timeoutSec,
         };
         if (failClosed)
             entry.failClosed = true;
@@ -140,6 +144,13 @@ async function installCursorHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.cursor/hooks.json)' : 'machine-wide (~/.cursor/hooks.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Events:${COLOR.reset} ${events.map((e) => EVENT_MAP[e].hookKey).join(', ')}`);
+    const actionEvents = events.filter((e) => e !== 'prompt');
+    if (actionEvents.length) {
+        console.log(`${COLOR.gray}Enforcement:${COLOR.reset} ${actionEvents.join(', ')} checked against your org Action Policies (allow / block / wait-for-human-approval) in every repo.`);
+    }
+    if (events.includes('prompt')) {
+        console.log(`${COLOR.gray}Prompts:${COLOR.reset} scanned by your Shield (developer-chat).`);
+    }
     if (shadow)
         console.log(`${COLOR.yellow}Mode: SHADOW (monitor only — nothing is blocked).${COLOR.reset}`);
     if (credFile)

package/dist/index.js

@@ -118,8 +118,10 @@ function printHelp() {
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
     install-cursor-hook
-                Installs a Cursor hook so every AI prompt + agent action
-                (shell, MCP) on this machine is scanned by your Shield.
+                Installs a Cursor hook so EVERY agent action on this machine is
+                checked against your org's Action Policies — in any repo/folder.
+                Prompts are scanned by your Shield; shell/MCP/file/read actions
+                are allowed, blocked, or paused for human approval per policy.
     uninstall-cursor-hook
                 Removes the FullCourtDefense Cursor hook entries.
     install-mcp-gateway
@@ -472,6 +474,9 @@ async function main() {
                 shadow: flags.shadow,
                 failClosed: flags['fail-closed'],
                 timeout: flags.timeout,
+                approvalMode: flags['approval-mode'],
+                approvalTimeoutMs: flags['approval-timeout-ms'],
+                approvalPollMs: flags['approval-poll-ms'],
             };
             await (0, hook_1.hookCommand)(args, config);
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.3.6"
+  "version": "1.4.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.3.6",
+  "version": "1.4.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {