fullcourtdefense-cli 1.3.7 → 1.5.0

package/dist/commands/hook.d.ts

@@ -3,12 +3,21 @@ import { BotGuardConfig } from '../config';
  * `fullcourtdefense hook` — Cursor hook bridge.
  *
  * Cursor invokes this command for agent lifecycle events (beforeSubmitPrompt,
- * beforeShellExecution, beforeMCPExecution, afterFileEdit, ...). Cursor pipes a
- * JSON payload on stdin and reads a JSON verdict on stdout. Exit code 2 also
- * blocks the action, which we use as the cross-event, cross-version-safe block
- * signal (not every event documents a `permission` output field).
+ * beforeShellExecution, beforeMCPExecution, afterFileEdit, beforeReadFile).
+ * Cursor pipes a JSON payload on stdin and reads a JSON verdict on stdout.
  *
- * Verdict source of truth: POST {apiUrl}/api/shield/analyze/{shieldId}.
+ * Two enforcement engines, by event:
+ *   - prompt  -> Shield text analysis (POST /api/shield/proxy/{shieldId}).
+ *               Action Policies don't apply to free-form chat, so prompts are
+ *               judged by the developer-chat Shield (monitor or block per mode).
+ *   - shell / mcp / file / read -> Action Policies, the SAME engine the MCP
+ *               gateway uses (POST /api/agent-security/runtime/check-tool-call).
+ *               The org's policies attached to the runtime identity decide:
+ *               allow / block / require_approval — enforced in EVERY repo on the
+ *               machine, regardless of which folder Cursor is open in.
+ *
+ * require_approval pauses the action and polls the approval endpoint until a
+ * human approves/rejects in the FullCourtDefense console (same as the gateway).
  */
 export interface HookArgs {
     event?: string;
@@ -18,5 +27,8 @@ export interface HookArgs {
     shadow?: string;
     failClosed?: string;
     timeout?: string;
+    approvalMode?: string;
+    approvalTimeoutMs?: string;
+    approvalPollMs?: string;
 }
 export declare function hookCommand(args: HookArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/hook.js

@@ -102,48 +102,72 @@ function inferEvent(explicit, payload) {
         return 'file';
     return 'unknown';
 }
-/** Pull the meaningful text to scan out of a Cursor hook payload, per event. */
-function extractText(event, p) {
-    const str = (v) => (typeof v === 'string' ? v : '');
+const str = (v) => (typeof v === 'string' ? v : '');
+/** Pull the meaningful text to scan out of a Cursor PROMPT hook payload. */
+function extractPromptText(p) {
+    const direct = str(p.prompt) || str(p.text) || str(p.message) || str(p.content);
+    if (direct)
+        return direct;
+    const promptObj = p.prompt;
+    if (promptObj && typeof promptObj === 'object') {
+        const t = str(promptObj.text) || str(promptObj.content);
+        if (t)
+            return t;
+    }
+    const messages = p.messages;
+    if (Array.isArray(messages) && messages.length) {
+        const last = messages[messages.length - 1];
+        return str(last?.content) || str(last?.text);
+    }
+    return '';
+}
+/**
+ * Map a Cursor execution-hook payload onto an Action Policy tool call.
+ * Returns null when there is nothing actionable to evaluate.
+ */
+function buildToolCall(event, p) {
     switch (event) {
-        case 'prompt': {
-            const direct = str(p.prompt) || str(p.text) || str(p.message) || str(p.content);
-            if (direct)
-                return direct;
-            // Some shapes nest the prompt or send a messages array.
-            const promptObj = p.prompt;
-            if (promptObj && typeof promptObj === 'object') {
-                const t = str(promptObj.text) || str(promptObj.content);
-                if (t)
-                    return t;
-            }
-            const messages = p.messages;
-            if (Array.isArray(messages) && messages.length) {
-                const last = messages[messages.length - 1];
-                return str(last?.content) || str(last?.text);
-            }
-            return '';
+        case 'shell': {
+            const command = str(p.command) || str(p.cmd);
+            if (!command)
+                return null;
+            return { toolName: 'shell', toolArgs: { command, cwd: str(p.cwd) || undefined } };
         }
-        case 'shell':
-            return str(p.command) || str(p.cmd);
         case 'mcp': {
-            const name = str(p.tool_name) || str(p.toolName) || str(p.name);
-            const input = p.tool_input ?? p.arguments ?? p.input ?? p.params;
-            const inputStr = typeof input === 'string' ? input : input ? safeJson(input) : '';
-            return [name, inputStr].filter(Boolean).join(': ');
+            const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
+            const rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
+            return { toolName, toolArgs };
         }
         case 'file': {
+            const filePath = str(p.file_path) || str(p.path);
             const edits = p.edits;
-            if (Array.isArray(edits)) {
-                return edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n');
-            }
-            return str(p.content) || str(p.new_text) || '';
+            const content = Array.isArray(edits)
+                ? edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n')
+                : (str(p.content) || str(p.new_text));
+            if (!filePath && !content)
+                return null;
+            return { toolName: 'edit_file', toolArgs: { path: filePath || undefined, content: content || undefined } };
+        }
+        case 'read': {
+            const filePath = str(p.file_path) || str(p.path);
+            if (!filePath)
+                return null;
+            return { toolName: 'read_file', toolArgs: { path: filePath } };
         }
-        case 'read':
-            return str(p.file_path) || str(p.path) || '';
         default:
-            return str(p.prompt) || str(p.text) || str(p.message) || str(p.command) || '';
+            return null;
+    }
+}
+function summarizeToolCall(toolName, toolArgs) {
+    const parts = [toolName];
+    for (const [k, v] of Object.entries(toolArgs)) {
+        if (v === undefined || v === null)
+            continue;
+        const sv = typeof v === 'string' ? v : safeJson(v);
+        parts.push(`${k}=${sv.slice(0, 200)}`);
     }
+    return parts.join(' ').slice(0, 500);
 }
 function safeJson(v) {
     try {
@@ -153,7 +177,7 @@ function safeJson(v) {
         return String(v);
     }
 }
-/** Per-event attribution that maps onto the existing Shield runtime headers. */
+/** Per-event attribution that maps onto the existing Shield runtime headers (prompt path). */
 function attributionFor(event, p) {
     const h = {};
     const set = (k, v) => { if (v)
@@ -164,33 +188,12 @@ function attributionFor(event, p) {
             set('x-runtime-event-type', 'user_message');
             set('x-runtime-trust', 'trusted_user');
             break;
-        case 'shell':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'action_request');
-            set('x-action-type', 'shell');
-            set('x-runtime-sink', 'execute');
-            set('x-runtime-trust', 'untrusted');
-            break;
-        case 'mcp':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'tool_call');
-            set('x-tool-name', String(p.tool_name || p.toolName || p.name || 'mcp'));
-            set('x-runtime-trust', 'untrusted');
-            break;
-        case 'file':
-            set('x-input-source', 'generated');
-            set('x-runtime-event-type', 'memory_write');
-            break;
-        case 'read':
-            set('x-input-source', 'tool');
-            set('x-runtime-event-type', 'memory_read');
-            break;
         default:
             set('x-input-source', 'user');
     }
     return h;
 }
-/** Stable developer identity, used for per-developer attribution on shield events. */
+/** Stable developer identity, used for per-developer attribution. */
 function developerId() {
     if (process.env.FULLCOURTDEFENSE_DEVELOPER_ID)
         return process.env.FULLCOURTDEFENSE_DEVELOPER_ID;
@@ -209,10 +212,29 @@ function sessionId(p) {
         return fromPayload;
     return `cursor-${os.hostname()}`;
 }
+function machineMetadata() {
+    let username = 'unknown';
+    try {
+        username = os.userInfo().username;
+    }
+    catch { /* ignore */ }
+    return {
+        developerName: developerId(),
+        machineName: os.hostname(),
+        os: `${os.platform()} ${os.release()}`,
+        username,
+        cwd: process.cwd(),
+        workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
+        agentClient: 'cursor',
+    };
+}
 async function hookCommand(args, config) {
     const shadow = args.shadow === 'true';
     const failClosed = args.failClosed === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
+    const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
+    const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000;
+    const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
         shieldKey: args.shieldKey,
@@ -245,13 +267,12 @@ async function hookCommand(args, config) {
         }
     }
     const event = inferEvent(args.event, payload);
-    const text = extractText(event, payload).trim();
     dbg({ phase: 'invoke', event, argEvent: args.event, pid: process.pid,
         isTTY, rawLen: raw.length, rawPreview: raw.slice(0, 300), stdinErr, parseErr,
-        argv: process.argv.slice(2), payloadKeys: Object.keys(payload), textPreview: text.slice(0, 80) });
+        argv: process.argv.slice(2), payloadKeys: Object.keys(payload) });
     // Emit the verdict in the shape Cursor expects for THIS event, then exit.
     // beforeSubmitPrompt blocks via { continue: false }; the execution hooks
-    // (shell/mcp/read) block via { permission: "deny" }. Exit 2 reinforces it.
+    // (shell/mcp/read) block via { permission: "deny" }.
     const respond = (blocked, userMsg, agentMsg) => {
         const decision = event === 'prompt'
             ? (blocked ? { continue: false } : { continue: true })
@@ -267,18 +288,154 @@ async function hookCommand(args, config) {
         // so exiting 2 would silently let blocked prompts through.
         process.exit(0);
     };
-    // Nothing to scan, or no Shield configured → allow (fail-open by design here:
-    // a misconfigured machine must not brick the developer's IDE).
-    if (!text)
-        respond(false);
+    // No Shield configured → allow (fail-open by design: a misconfigured machine
+    // must not brick the developer's IDE).
     if (!shieldId) {
-        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense configure`).');
+        respond(false, undefined, 'FullCourtDefense hook installed but no Shield ID configured (run `fullcourtdefense setup`).');
+    }
+    // --- Action Policy enforcement for actions (shell / mcp / file / read) ---
+    if (event === 'shell' || event === 'mcp' || event === 'file' || event === 'read') {
+        await enforceActionPolicy({
+            event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
+            shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond,
+        });
+        return;
+    }
+    // --- Shield text analysis for prompts (developer chat) ---
+    if (event === 'prompt') {
+        const text = extractPromptText(payload).trim();
+        if (!text)
+            respond(false);
+        await enforceShieldText({
+            event, text, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
+            shadow, failClosed, timeoutMs, respond,
+        });
+        return;
+    }
+    // Unknown event → nothing to enforce.
+    respond(false);
+}
+async function enforceActionPolicy(ctx) {
+    const { event, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
+    const call = buildToolCall(event, payload);
+    if (!call) {
+        respond(false);
+        return;
     }
+    const headers = { 'Content-Type': 'application/json' };
+    if (shieldKey)
+        headers['x-shield-key'] = shieldKey;
+    let result;
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        const resp = await fetch(`${apiUrl}/api/agent-security/runtime/check-tool-call`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                shieldId,
+                agentName: `cursor-${developerId()}`,
+                toolName: call.toolName,
+                toolArgs: call.toolArgs,
+                argsSummary: summarizeToolCall(call.toolName, call.toolArgs),
+                sessionId: sessionId(payload),
+                source: 'cursor_hook',
+                ...machineMetadata(),
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!resp.ok) {
+            dbg({ phase: 'policy_http_error', event, status: resp.status });
+            respond(failClosed, failClosed ? `FullCourtDefense policy gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense policy gate returned HTTP ${resp.status}.`);
+            return;
+        }
+        const body = await resp.json().catch(() => ({}));
+        if (!body.success || !body.data) {
+            dbg({ phase: 'policy_no_data', event, error: body.error });
+            respond(failClosed, failClosed ? 'FullCourtDefense policy gate error — blocked by fail-closed policy.' : undefined, body.error);
+            return;
+        }
+        result = body.data;
+    }
+    catch (err) {
+        dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err) });
+        respond(failClosed, failClosed ? 'FullCourtDefense policy gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        return;
+    }
+    const reason = result.actionPolicy?.reason
+        || result.intentEvaluation?.reasons?.[0]
+        || `${call.toolName} ${result.decision}ed by Action Policy.`;
+    const policyName = result.actionPolicy?.policyName;
+    dbg({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
+    if (result.allowed && result.decision === 'allow') {
+        respond(false);
+        return;
+    }
+    // require_approval — pause and wait for a human to approve in the console.
+    if (result.decision === 'approval') {
+        if (shadow) {
+            respond(false, undefined, `[FullCourtDefense shadow] would require approval for ${call.toolName}${policyName ? ` (${policyName})` : ''}: ${reason}`);
+            return;
+        }
+        if (ctx.approvalMode === 'block' || !result.approvalActionId) {
+            respond(true, `Approval required by FullCourtDefense${policyName ? ` (${policyName})` : ''} — ${reason}`, `This ${event} requires human approval per Action Policy. Stop and ask the developer to approve it in the FullCourtDefense console.`);
+            return;
+        }
+        const outcome = await waitForApproval({
+            apiUrl, shieldId, shieldKey, actionId: result.approvalActionId,
+            timeoutMs: ctx.approvalTimeoutMs, pollMs: ctx.approvalPollMs,
+        });
+        if (outcome.status === 'approved') {
+            respond(false, undefined, `FullCourtDefense: human approved this ${event}.`);
+            return;
+        }
+        respond(true, `FullCourtDefense: ${outcome.message}`, `This ${event} was not approved (${outcome.status}). Do not retry until a human approves it in the FullCourtDefense console.`);
+        return;
+    }
+    // block / mask / any other not-allowed decision.
+    if (shadow) {
+        respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}${policyName ? ` (${policyName})` : ''}: ${reason}`);
+        return;
+    }
+    respond(true, `Blocked by FullCourtDefense${policyName ? ` (${policyName})` : ''} — ${reason}`, `FullCourtDefense blocked this ${event} per Action Policy: ${reason}. Do not retry.`);
+}
+async function waitForApproval(input) {
+    const headers = { 'Content-Type': 'application/json' };
+    if (input.shieldKey)
+        headers['x-shield-key'] = input.shieldKey;
+    const url = `${input.apiUrl}/api/agent-security/runtime/approvals/${encodeURIComponent(input.actionId)}?shieldId=${encodeURIComponent(input.shieldId)}`;
+    const deadline = Date.now() + input.timeoutMs;
+    dbg({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: input.timeoutMs });
+    while (Date.now() <= deadline) {
+        try {
+            const resp = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(15000) });
+            if (resp.ok) {
+                const body = await resp.json().catch(() => ({}));
+                const approval = body.data?.approval;
+                if (approval?.approvalStatus === 'approved') {
+                    return { status: 'approved', message: 'approved by a human reviewer.' };
+                }
+                if (approval?.approvalStatus === 'rejected') {
+                    return { status: 'rejected', message: `approval rejected for ${approval.toolName}.` };
+                }
+                if (approval?.approvalStatus === 'expired') {
+                    return { status: 'expired', message: `approval expired for ${approval.toolName}.` };
+                }
+            }
+        }
+        catch (err) {
+            dbg({ phase: 'approval_poll_error', actionId: input.actionId, error: err instanceof Error ? err.message : String(err) });
+        }
+        await new Promise((resolve) => setTimeout(resolve, Math.min(input.pollMs, Math.max(0, deadline - Date.now()))));
+    }
+    return { status: 'timeout', message: 'approval timed out — still waiting for human review.' };
+}
+async function enforceShieldText(ctx) {
+    const { event, text, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
     try {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
-        // Behaves exactly like a normal Shield agent calling the public proxy:
-        // Shield key + runtime/developer attribution headers, body { message }.
         const headers = {
             'Content-Type': 'application/json',
             'x-runtime-source-id': developerId(),
@@ -296,28 +453,21 @@ async function hookCommand(args, config) {
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            // Backend rejected (quota, bad shield, etc.) — fail open unless told otherwise.
             respond(failClosed, failClosed ? `FullCourtDefense gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense gate returned HTTP ${resp.status}.`);
         }
         const data = await resp.json().catch(() => ({}));
         const sh = (data._shield || {});
         const action = String(sh.action || '');
-        // Proxy returns 'blocked_input' / 'blocked_output' when it blocks; in monitor
-        // mode it returns 'allowed' (never block, even if wouldBlock is set).
         const isBlocked = action.startsWith('blocked');
         const reason = String(sh.reason || 'policy_violation');
         const explanation = String(sh.reason || 'Flagged by FullCourtDefense.');
-        if (!isBlocked) {
+        if (!isBlocked)
             respond(false);
-        }
-        // Blocked verdict. In shadow mode we annotate but let it through.
-        if (shadow) {
+        if (shadow)
             respond(false, undefined, `[FullCourtDefense shadow] would block ${event} (${reason}): ${explanation}`);
-        }
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
-        // Network error / timeout.
         respond(failClosed, failClosed ? 'FullCourtDefense gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
     }
 }

package/dist/commands/installCursorHook.js

@@ -47,12 +47,16 @@ const COLOR = {
 // find our entries regardless of the install path (npm global vs local dev).
 const MANAGED_MARKER = '--fcd-managed true';
 const MANAGED_TAG = 'fullcourtdefense';
+// `timeoutSec` is the Cursor-side hook timeout. Action events can pause for a
+// human approval decision, so they need a long timeout (Cursor kills the hook
+// at this limit). Allow/block verdicts still return in <1s — the long timeout
+// only matters while waiting for a human to approve in the console.
 const EVENT_MAP = {
-    prompt: { hookKey: 'beforeSubmitPrompt', flag: 'prompt', failClosedDefault: false },
-    shell: { hookKey: 'beforeShellExecution', flag: 'shell', failClosedDefault: true },
-    mcp: { hookKey: 'beforeMCPExecution', flag: 'mcp', failClosedDefault: true },
-    file: { hookKey: 'afterFileEdit', flag: 'file', failClosedDefault: false },
-    read: { hookKey: 'beforeReadFile', flag: 'read', failClosedDefault: false },
+    prompt: { hookKey: 'beforeSubmitPrompt', flag: 'prompt', failClosedDefault: false, timeoutSec: 10 },
+    shell: { hookKey: 'beforeShellExecution', flag: 'shell', failClosedDefault: true, timeoutSec: 300 },
+    mcp: { hookKey: 'beforeMCPExecution', flag: 'mcp', failClosedDefault: true, timeoutSec: 300 },
+    file: { hookKey: 'afterFileEdit', flag: 'file', failClosedDefault: false, timeoutSec: 300 },
+    read: { hookKey: 'beforeReadFile', flag: 'read', failClosedDefault: false, timeoutSec: 300 },
 };
 /** Build the absolute, shell-agnostic command that invokes this CLI's `hook`. */
 function buildHookCommand(flag, opts) {
@@ -120,11 +124,11 @@ async function installCursorHookCommand(args, config) {
     const credFile = ensureHomeShield(creds);
     const json = readHooksJson(file);
     for (const e of events) {
-        const { hookKey, flag, failClosedDefault } = EVENT_MAP[e];
+        const { hookKey, flag, failClosedDefault, timeoutSec } = EVENT_MAP[e];
         const failClosed = args.failClosed !== undefined ? args.failClosed === 'true' : failClosedDefault;
         const entry = {
             command: buildHookCommand(flag, { shadow, failClosed }),
-            timeout: 10,
+            timeout: timeoutSec,
         };
         if (failClosed)
             entry.failClosed = true;
@@ -140,6 +144,13 @@ async function installCursorHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.cursor/hooks.json)' : 'machine-wide (~/.cursor/hooks.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Events:${COLOR.reset} ${events.map((e) => EVENT_MAP[e].hookKey).join(', ')}`);
+    const actionEvents = events.filter((e) => e !== 'prompt');
+    if (actionEvents.length) {
+        console.log(`${COLOR.gray}Enforcement:${COLOR.reset} ${actionEvents.join(', ')} checked against your org Action Policies (allow / block / wait-for-human-approval) in every repo.`);
+    }
+    if (events.includes('prompt')) {
+        console.log(`${COLOR.gray}Prompts:${COLOR.reset} scanned by your Shield (developer-chat).`);
+    }
     if (shadow)
         console.log(`${COLOR.yellow}Mode: SHADOW (monitor only — nothing is blocked).${COLOR.reset}`);
     if (credFile)

package/dist/commands/mcpGateway.d.ts

@@ -58,6 +58,12 @@ export interface InstallMcpGatewayArgs extends McpGatewayArgs {
 export declare function mcpGatewayCommand(args: McpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installCursorMcpGatewayCommand(args: InstallCursorMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installMcpGatewayCommand(args: InstallMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
+export interface ProtectAllArgs extends McpGatewayArgs {
+    dryRun?: string;
+    config?: string;
+}
+export declare function protectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
+export declare function unprotectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
 export declare function installClaudeCodeMcpGatewayCommand(args: InstallClaudeCodeMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installClaudeDesktopMcpGatewayCommand(args: InstallClaudeDesktopMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installCodexMcpGatewayCommand(args: InstallCodexMcpGatewayArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/mcpGateway.js

@@ -37,6 +37,8 @@ exports.ALL_GATEWAY_CLIENTS = void 0;
 exports.mcpGatewayCommand = mcpGatewayCommand;
 exports.installCursorMcpGatewayCommand = installCursorMcpGatewayCommand;
 exports.installMcpGatewayCommand = installMcpGatewayCommand;
+exports.protectAllCommand = protectAllCommand;
+exports.unprotectAllCommand = unprotectAllCommand;
 exports.installClaudeCodeMcpGatewayCommand = installClaudeCodeMcpGatewayCommand;
 exports.installClaudeDesktopMcpGatewayCommand = installClaudeDesktopMcpGatewayCommand;
 exports.installCodexMcpGatewayCommand = installCodexMcpGatewayCommand;
@@ -940,6 +942,360 @@ async function installMcpGatewayCommand(args, config) {
         console.log('Add --upload to refresh AI Fleet after install.');
     }
 }
+const CLIENT_KEY_TO_AGENT = {
+    cursor: 'cursor',
+    claude_code: 'claude-code',
+    claude_desktop: 'claude-desktop',
+    codex: 'codex',
+    gemini_cli: 'gemini-cli',
+    windsurf: 'windsurf',
+    vscode: 'vscode',
+};
+function newWrapStats() { return { wrapped: [], skippedManaged: [], skippedRemote: [] }; }
+/** True when an MCP server entry already runs through the AgentGuard gateway. */
+function isGatewayWrappedEntry(entry) {
+    if (!entry || typeof entry !== 'object')
+        return false;
+    const args = Array.isArray(entry.args) ? entry.args.map(String) : [];
+    return args.includes('mcp-gateway');
+}
+/** Recover the original downstream command+args from a wrapped entry's args. */
+function extractWrappedDownstream(entry) {
+    const args = Array.isArray(entry?.args) ? entry.args.map(String) : [];
+    const ci = args.indexOf('--mcp-command');
+    if (ci === -1 || ci + 1 >= args.length)
+        return null;
+    const command = args[ci + 1];
+    let downstreamArgs = [];
+    const ai = args.indexOf('--mcp-args');
+    if (ai !== -1 && args[ai + 1]) {
+        try {
+            const parsed = JSON.parse(args[ai + 1]);
+            if (Array.isArray(parsed))
+                downstreamArgs = parsed.map(String);
+        }
+        catch { /* leave empty */ }
+    }
+    return { command, args: downstreamArgs };
+}
+/** All server maps inside a parsed JSON config, across every known client shape. */
+function collectJsonServerMaps(json) {
+    const maps = [];
+    const pushIfMap = (m) => { if (m && typeof m === 'object' && !Array.isArray(m))
+        maps.push(m); };
+    if (json && typeof json === 'object') {
+        pushIfMap(json.mcpServers); // Cursor, Claude, Gemini, Windsurf, Kiro, Codex mcp.json
+        pushIfMap(json.servers); // VS Code .vscode/mcp.json
+        if (json.mcp && typeof json.mcp === 'object')
+            pushIfMap(json.mcp.servers); // VS Code settings.json
+        if (json.projects && typeof json.projects === 'object') {
+            for (const proj of Object.values(json.projects))
+                pushIfMap(proj?.mcpServers); // Claude Code .claude.json
+        }
+    }
+    return maps;
+}
+function backupFile(file) {
+    try {
+        const bak = `${file}.fcd-backup-${Date.now()}`;
+        fs.copyFileSync(file, bak);
+    }
+    catch { /* best effort */ }
+}
+function perServerAgentName(developerName, agentClient, serverName) {
+    return `${safeIdentityPart(developerName)}-${agentClient}-${safeIdentityPart(serverName)}`;
+}
+function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
+    const stats = newWrapStats();
+    let json;
+    try {
+        json = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null; // not JSON / unreadable — skip silently
+    }
+    if (!json || typeof json !== 'object')
+        return null;
+    const maps = collectJsonServerMaps(json);
+    if (maps.length === 0)
+        return stats;
+    const nodeExe = process.execPath;
+    let changed = false;
+    for (const map of maps) {
+        for (const [name, entry] of Object.entries(map)) {
+            if (!entry || typeof entry !== 'object')
+                continue;
+            if (name === MANAGED_SERVER_NAME || isGatewayWrappedEntry(entry)) {
+                stats.skippedManaged.push(name);
+                continue;
+            }
+            if (typeof entry.command !== 'string' || !entry.command) {
+                stats.skippedRemote.push(name);
+                continue;
+            }
+            const downstreamCommand = entry.command;
+            const downstreamArgs = Array.isArray(entry.args) ? entry.args.map(String) : [];
+            const perServer = { ...gatewayConfig, agentName: perServerAgentName(gatewayConfig.developerName, agentClient, name) };
+            const wrappedArgs = buildGatewayCommandArgs(perServer, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
+            entry.command = nodeExe;
+            entry.args = wrappedArgs;
+            // entry.env and any other fields are preserved as-is.
+            stats.wrapped.push(name);
+            changed = true;
+        }
+    }
+    if (changed && !dryRun) {
+        backupFile(file);
+        fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
+    }
+    return stats;
+}
+function unwrapJsonConfigFile(file, dryRun) {
+    let json;
+    try {
+        json = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!json || typeof json !== 'object')
+        return null;
+    const maps = collectJsonServerMaps(json);
+    const restored = [];
+    let changed = false;
+    for (const map of maps) {
+        for (const [name, entry] of Object.entries(map)) {
+            if (name === MANAGED_SERVER_NAME) {
+                delete map[name];
+                changed = true;
+                continue;
+            }
+            if (!isGatewayWrappedEntry(entry))
+                continue;
+            const downstream = extractWrappedDownstream(entry);
+            if (!downstream)
+                continue;
+            entry.command = downstream.command;
+            entry.args = downstream.args;
+            restored.push(name);
+            changed = true;
+        }
+    }
+    if (changed && !dryRun) {
+        backupFile(file);
+        fs.writeFileSync(file, `${JSON.stringify(json, null, 2)}\n`, 'utf8');
+    }
+    return { restored };
+}
+/** Parse a single-line TOML scalar string value: command = "x". */
+function parseTomlInlineString(line) {
+    const m = line.match(/=\s*"((?:[^"\\]|\\.)*)"/);
+    if (!m)
+        return undefined;
+    try {
+        return JSON.parse(`"${m[1]}"`);
+    }
+    catch {
+        return m[1];
+    }
+}
+/** Parse a single-line TOML string array: args = ["a", "b"]. */
+function parseTomlInlineStringArray(line) {
+    const m = line.match(/=\s*(\[.*\])\s*$/);
+    if (!m)
+        return undefined;
+    try {
+        const parsed = JSON.parse(m[1]);
+        if (Array.isArray(parsed))
+            return parsed.map(String);
+    }
+    catch { /* not single-line */ }
+    return undefined;
+}
+function tomlStringArrayLiteral(values) {
+    return `[${values.map(v => JSON.stringify(v)).join(', ')}]`;
+}
+/**
+ * Wrap/unwrap Codex config.toml in place, line by line, so [mcp_servers.NAME.env]
+ * subtables and unrelated config are preserved. Only single-line command/args
+ * are handled; multi-line arrays are skipped (rare for MCP servers).
+ */
+function transformCodexToml(file, mode, gatewayConfig, dryRun) {
+    let content;
+    try {
+        content = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const lines = content.split(/\r?\n/);
+    const stats = newWrapStats();
+    const nodeExe = process.execPath;
+    const sections = [];
+    let current = null;
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        const header = trimmed.match(/^\[(.+?)\]\s*$/);
+        if (header) {
+            const tablePath = header[1];
+            const isServer = /^mcp_servers\.[^.]+$/.test(tablePath);
+            if (isServer) {
+                current = { name: tablePath.slice('mcp_servers.'.length), cmdLine: -1, argsLine: -1 };
+                sections.push(current);
+            }
+            else
+                current = null;
+            continue;
+        }
+        if (current) {
+            if (/^command\s*=/.test(trimmed) && current.cmdLine === -1) {
+                current.cmdLine = i;
+                current.command = parseTomlInlineString(lines[i]);
+            }
+            else if (/^args\s*=/.test(trimmed) && current.argsLine === -1) {
+                current.argsLine = i;
+                current.args = parseTomlInlineStringArray(lines[i]);
+            }
+        }
+    }
+    let changed = false;
+    for (const section of sections) {
+        if (section.cmdLine === -1 || !section.command) {
+            continue;
+        }
+        const wrappedAlready = section.command === nodeExe && (section.args || []).includes('mcp-gateway');
+        if (mode === 'wrap') {
+            if (section.name === MANAGED_SERVER_NAME || wrappedAlready) {
+                stats.skippedManaged.push(section.name);
+                continue;
+            }
+            const perServer = { ...gatewayConfig, agentName: perServerAgentName(gatewayConfig.developerName, 'codex', section.name) };
+            const wrappedArgs = buildGatewayCommandArgs(perServer, section.command, section.args || [], INSTALL_GATEWAY_ARGS);
+            const indent = lines[section.cmdLine].match(/^\s*/)?.[0] || '';
+            lines[section.cmdLine] = `${indent}command = ${JSON.stringify(nodeExe)}`;
+            const argsLineText = `${indent}args = ${tomlStringArrayLiteral(wrappedArgs)}`;
+            if (section.argsLine !== -1)
+                lines[section.argsLine] = argsLineText;
+            else
+                lines.splice(section.cmdLine + 1, 0, argsLineText);
+            stats.wrapped.push(section.name);
+            changed = true;
+        }
+        else {
+            if (!wrappedAlready)
+                continue;
+            const downstream = extractWrappedDownstream({ args: section.args });
+            if (!downstream)
+                continue;
+            const indent = lines[section.cmdLine].match(/^\s*/)?.[0] || '';
+            lines[section.cmdLine] = `${indent}command = ${JSON.stringify(downstream.command)}`;
+            if (section.argsLine !== -1)
+                lines[section.argsLine] = `${indent}args = ${tomlStringArrayLiteral(downstream.args)}`;
+            stats.wrapped.push(section.name);
+            changed = true;
+        }
+    }
+    if (changed && !dryRun) {
+        backupFile(file);
+        fs.writeFileSync(file, lines.join('\n'), 'utf8');
+    }
+    return stats;
+}
+function protectAllTargetFiles(extra) {
+    const cwd = process.cwd();
+    const seen = new Set();
+    const files = [];
+    for (const candidate of (0, discoverPaths_1.candidateConfigPaths)(cwd, extra)) {
+        const key = path.resolve(candidate.path).toLowerCase();
+        if (seen.has(key))
+            continue;
+        if (!fs.existsSync(candidate.path))
+            continue;
+        seen.add(key);
+        files.push(candidate);
+    }
+    for (const target of (0, discoverPaths_1.claudeDesktopInstallTargets)()) {
+        const key = path.resolve(target.file).toLowerCase();
+        if (target.exists && !seen.has(key)) {
+            seen.add(key);
+            files.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+        }
+    }
+    return files;
+}
+async function protectAllCommand(args, config) {
+    (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireOrganizationId: false });
+    const gatewayConfig = resolveGatewayConfig(args, config);
+    const dryRun = args.dryRun === 'true';
+    const files = protectAllTargetFiles(args.config);
+    console.log('\n\x1b[1m\x1b[36mFullCourtDefense — protect every MCP server in every client\x1b[0m');
+    console.log(`\x1b[2mRuntime identity: ${gatewayConfig.developerName}  |  Shield: ${gatewayConfig.shieldId}${dryRun ? '  |  DRY RUN' : ''}\x1b[0m\n`);
+    if (files.length === 0) {
+        console.log('No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
+        return;
+    }
+    let totalWrapped = 0;
+    let totalManaged = 0;
+    let totalRemote = 0;
+    for (const file of files) {
+        const agentClient = CLIENT_KEY_TO_AGENT[file.clientKey] || 'cursor';
+        const isToml = /\.toml$/i.test(file.path);
+        const stats = isToml
+            ? transformCodexToml(file.path, 'wrap', gatewayConfig, dryRun)
+            : wrapJsonConfigFile(file.path, gatewayConfig, agentClient, dryRun);
+        if (!stats)
+            continue;
+        if (stats.wrapped.length === 0 && stats.skippedManaged.length === 0 && stats.skippedRemote.length === 0)
+            continue;
+        totalWrapped += stats.wrapped.length;
+        totalManaged += stats.skippedManaged.length;
+        totalRemote += stats.skippedRemote.length;
+        console.log(`\x1b[1m${file.source}\x1b[0m  \x1b[2m${file.path}\x1b[0m`);
+        if (stats.wrapped.length)
+            console.log(`  \x1b[32m✓ wrapped:\x1b[0m ${stats.wrapped.join(', ')}`);
+        if (stats.skippedManaged.length)
+            console.log(`  \x1b[2m• already protected:\x1b[0m ${stats.skippedManaged.join(', ')}`);
+        if (stats.skippedRemote.length)
+            console.log(`  \x1b[33m• skipped (remote/no command):\x1b[0m ${stats.skippedRemote.join(', ')}`);
+        console.log('');
+    }
+    console.log('\x1b[1mSummary\x1b[0m');
+    console.log(`  ${dryRun ? 'would wrap' : 'wrapped'}: ${totalWrapped}   already protected: ${totalManaged}   skipped remote: ${totalRemote}`);
+    console.log(`  Each protected server enforces your org Action Policies (allow / block / wait-for-human-approval) on its tool calls.`);
+    if (!dryRun && totalWrapped > 0)
+        console.log('  Backups saved next to each edited file (*.fcd-backup-*). Restart each client to load the protected servers.');
+    console.log('  Reverse anytime with: \x1b[1mfullcourtdefense unprotect-all\x1b[0m');
+}
+async function unprotectAllCommand(args, config) {
+    const dryRun = args.dryRun === 'true';
+    const files = protectAllTargetFiles(args.config);
+    let gatewayConfig;
+    try {
+        gatewayConfig = resolveGatewayConfig(args, config);
+    }
+    catch { /* unwrap doesn't need creds */ }
+    const fallbackConfig = gatewayConfig || { developerName: 'local-user' };
+    console.log('\n\x1b[1m\x1b[36mFullCourtDefense — remove gateway wrapping from all clients\x1b[0m\n');
+    let total = 0;
+    for (const file of files) {
+        const isToml = /\.toml$/i.test(file.path);
+        if (isToml) {
+            const stats = transformCodexToml(file.path, 'unwrap', fallbackConfig, dryRun);
+            if (stats && stats.wrapped.length) {
+                total += stats.wrapped.length;
+                console.log(`\x1b[1m${file.source}\x1b[0m restored: ${stats.wrapped.join(', ')}`);
+            }
+        }
+        else {
+            const res = unwrapJsonConfigFile(file.path, dryRun);
+            if (res && res.restored.length) {
+                total += res.restored.length;
+                console.log(`\x1b[1m${file.source}\x1b[0m restored: ${res.restored.join(', ')}`);
+            }
+        }
+    }
+    console.log(`\n${dryRun ? 'Would restore' : 'Restored'} ${total} server(s) to their original commands. Restart each client.`);
+}
 async function installClaudeCodeMcpGatewayCommand(args, config) {
     const gatewayConfig = resolveGatewayConfig(args, config, {
         agentClient: 'claude-code',

package/dist/index.js

@@ -118,10 +118,18 @@ function printHelp() {
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
     install-cursor-hook
-                Installs a Cursor hook so every AI prompt + agent action
-                (shell, MCP) on this machine is scanned by your Shield.
+                Installs a Cursor hook so EVERY agent action on this machine is
+                checked against your org's Action Policies — in any repo/folder.
+                Prompts are scanned by your Shield; shell/MCP/file/read actions
+                are allowed, blocked, or paused for human approval per policy.
     uninstall-cursor-hook
                 Removes the FullCourtDefense Cursor hook entries.
+    protect-all Auto-detect EVERY MCP server already configured in EVERY client
+                (Cursor, Claude Code/Desktop, Codex, Gemini, Windsurf, VS Code)
+                and wrap each through the Shield proxy — no --mcp-command needed.
+                Enforces your org Action Policies on every tool. --dry-run to preview.
+    unprotect-all
+                Reverse protect-all: restore every server to its original command.
     install-mcp-gateway
                 Install MCP gateway into selected clients (--clients all for every tool).
     install-cursor-mcp-gateway
@@ -472,6 +480,9 @@ async function main() {
                 shadow: flags.shadow,
                 failClosed: flags['fail-closed'],
                 timeout: flags.timeout,
+                approvalMode: flags['approval-mode'],
+                approvalTimeoutMs: flags['approval-timeout-ms'],
+                approvalPollMs: flags['approval-poll-ms'],
             };
             await (0, hook_1.hookCommand)(args, config);
             break;
@@ -494,6 +505,26 @@ async function main() {
             await (0, mcpGateway_1.installMcpGatewayCommand)(buildInstallArgs(), config);
             break;
         }
+        case 'protect-all':
+        case 'wrap-all': {
+            const args = {
+                ...buildGatewayArgs(),
+                dryRun: flags['dry-run'],
+                config: flags.config,
+            };
+            await (0, mcpGateway_1.protectAllCommand)(args, config);
+            break;
+        }
+        case 'unprotect-all':
+        case 'unwrap-all': {
+            const args = {
+                ...buildGatewayArgs(),
+                dryRun: flags['dry-run'],
+                config: flags.config,
+            };
+            await (0, mcpGateway_1.unprotectAllCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 ...buildGatewayArgs(),

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.3.7"
+  "version": "1.5.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.3.7",
+  "version": "1.5.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {