fullcourtdefense-cli 1.30.0 → 1.31.0

package/dist/actionPolicyEngine.d.ts

@@ -157,7 +157,7 @@ export declare function toolCapabilities(value: string): Set<string>;
  *   - known token formats (GitHub, AWS, Google, OpenAI/Anthropic, Slack, JWT)
  *   - private-key PEM blocks
  *   - an ASSIGNMENT of a secret-named field to a REAL value:
- *     `password=Hunter2!2024`, `"api_key": "sk-…"`, `--token abc…` — where the
+ *     `password=<real value>`, `"api_key": "sk-…"`, `--token abc…` — where the
  *     value is not a placeholder (`<your-key>`, `xxxx`, `changeme`, `${VAR}`,
  *     `process.env.X`), not a code expression (`req.body.password`,
  *     `config.get('token')`) and has real-secret shape (>= 8 chars, >= 2

package/dist/actionPolicyEngine.js

@@ -511,6 +511,17 @@ function isHighEntropySecretToken(token) {
     // the password inside its userinfo can be a secret — judged as a value.
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
         return looksLikeSecretValue(token);
+    // A generic token is TOKEN-SHAPED: base64 / base64url / hex / a prefixed id.
+    // Source code that happens to sit after `=` or `:` — call expressions
+    // (`parseInput(args.files`), member chains (`process.env.GITHUB_REPOSITORY`),
+    // regex literals, array indexing — carries parens, brackets and operators
+    // that no credential format uses. Structural, so it holds for every language.
+    if (!/^[A-Za-z0-9._~+/=-]+$/.test(token))
+        return false;
+    // A dotted chain of identifiers (`config.auth.clientSecret`, `DEFAULT_POLICY.scope`)
+    // is a reference to a value, not the value.
+    if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(token))
+        return false;
     if (/^[0-9a-f]+$/i.test(token))
         return false; // hex digest / git sha
     if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token))

package/dist/commands/agentCi.d.ts

@@ -12,4 +12,6 @@ export interface AgentCiArgs {
     apiKey?: string;
     apiUrl?: string;
 }
+/** True when the path lives under the repository being gated (not the runner's home / system dirs). */
+export declare function isInsideRepo(cwd: string, filePath?: string): boolean;
 export declare function agentCiCommand(args: AgentCiArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/agentCi.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInsideRepo = isInsideRepo;
 exports.agentCiCommand = agentCiCommand;
 const crypto = __importStar(require("crypto"));
 const child_process_1 = require("child_process");
@@ -201,6 +202,13 @@ function resolveChangedFiles(cwd, args) {
         return null;
     return new Set(files.map(file => normalizeRelativePath(cwd, file)));
 }
+/** True when the path lives under the repository being gated (not the runner's home / system dirs). */
+function isInsideRepo(cwd, filePath) {
+    if (!filePath)
+        return false;
+    const rel = path.relative(path.resolve(cwd), path.resolve(cwd, filePath));
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
 function isChangedFile(cwd, changedFiles, filePath) {
     if (!changedFiles)
         return true;
@@ -234,7 +242,13 @@ function evaluateAgentGate(args) {
     const agentFiles = (0, discoverAgentFiles_1.scanAgentFiles)({ cwd })
         .filter(file => isChangedFile(cwd, changedFiles, file.filePath));
     const secrets = (0, discoverSecrets_1.scanSecrets)({ cwd, maxEnvDepth: 3 });
+    // agent-ci is a gate on the REPOSITORY. The secrets scanner also inspects the
+    // host's credential stores (~/.docker/config.json, ~/.kube/config, ~/.aws, …);
+    // on a CI runner those belong to the runner image, not to the code under
+    // review, and the developer cannot fix them from the PR. Host posture is the
+    // `discover` command's job — here only findings inside the repo count.
     const secretFindings = secrets.findings
+        .filter(item => isInsideRepo(cwd, item.filePath))
         .filter(item => isChangedFile(cwd, changedFiles, item.filePath));
     const requireGateway = args.requireGateway !== 'false';
     const requiredControls = parseRequiredControls(args.requireApprovalFor);

package/dist/commands/discover.js

@@ -668,7 +668,7 @@ function describeMissingUploadCreds(config, creds) {
         parts.push('no org API key');
     return parts.join('; ') || 'unknown';
 }
-async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName, extras) {
+async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName, extras, silent = false) {
     const payload = {
         connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
         host,
@@ -736,6 +736,11 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
     // Any successful inventory upload satisfies the daemon's "initial discovery"
     // requirement — onboard-time, manual, scheduled, or remote-action sweeps all count.
     (0, discoveryMarker_1.writeDiscoveryUploadMarker)('discover_upload');
+    // Silent callers (agent-ci --format sarif|json, scheduled sweeps) own stdout:
+    // a human line here would land INSIDE the machine-readable document they are
+    // emitting and break the consumer (GitHub code scanning rejects the SARIF).
+    if (silent)
+        return;
     const postureNote = extras?.posture ? ` · machine score ${extras.posture.score}/100 (${extras.posture.grade})` : '';
     console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory${postureNote}.${COLOR.reset}`);
 }
@@ -1017,7 +1022,7 @@ async function discoverCommand(args, config) {
             console.error(`discover --upload: missing credentials (${describeMissingUploadCreds(config, creds)}). Run \`fullcourtdefense login --token <fleet-enrollment-token>\`.`);
             process.exit(1);
         }
-        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
+        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras, silent || args.json === 'true');
     }
     if (args.json === 'true') {
         await maybeUpload();

package/dist/commands/hook.d.ts

@@ -53,6 +53,41 @@ export declare function normalizeClaudePayload(payload: Record<string, unknown>)
     event: HookEvent | 'ignore';
     payload: Record<string, unknown>;
 } | null;
+export declare function canonicalBuiltinToolName(toolName: string): string;
+/**
+ * Map a built-in IDE tool (any client) onto our event taxonomy. Returns null
+ * for a tool name this layer does not recognize so the caller keeps its own
+ * default (Claude: ignore; Cursor: treat as an MCP tool).
+ */
+export declare function mapBuiltinToolPayload(toolName: string, input: Record<string, unknown>, payload: Record<string, unknown>): {
+    event: HookEvent | 'ignore';
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Cursor delivers its OWN built-in tools (Shell / Read / Write / Grep / …)
+ * through the same execution hook as MCP servers, with `tool_use_id` + no
+ * server identity (`mcp_server_name` / `url` / `command` are MCP-only). Route
+ * them through the shared taxonomy so an IDE edit is a FILE action, a command
+ * is a SHELL action, and neither is ever judged as an unknown MCP tool.
+ *
+ * Shell is dropped here on purpose: Cursor also fires `beforeShellExecution`
+ * for the same command, which is the authoritative shell surface — evaluating
+ * it twice produced two (sometimes different) verdicts for one action.
+ */
+export declare function normalizeCursorBuiltinTool(payload: Record<string, unknown>): {
+    event: HookEvent | 'ignore';
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Cursor-format entry: infer the event from the `--event` flag / payload shape,
+ * then route Cursor built-in tools through the shared taxonomy. Exported so the
+ * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
+ */
+export declare function canonicalizeCursorPayload(argEvent: string | undefined, payload: Record<string, unknown>): {
+    event: HookEvent;
+    payload: Record<string, unknown>;
+    ignore: boolean;
+};
 /**
  * Map a Cursor execution-hook payload onto an Action Policy tool call.
  * Returns null when there is nothing actionable to evaluate.

package/dist/commands/hook.js

@@ -34,6 +34,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeClaudePayload = normalizeClaudePayload;
+exports.canonicalBuiltinToolName = canonicalBuiltinToolName;
+exports.mapBuiltinToolPayload = mapBuiltinToolPayload;
+exports.normalizeCursorBuiltinTool = normalizeCursorBuiltinTool;
+exports.canonicalizeCursorPayload = canonicalizeCursorPayload;
 exports.buildToolCall = buildToolCall;
 exports.classifyGateHttpFailure = classifyGateHttpFailure;
 exports.gateHttpFailureDetail = gateHttpFailureDetail;
@@ -59,6 +63,7 @@ const devConfirm_1 = require("../devConfirm");
 // Shared with the slim hook entry (hookSlim.ts) so both entries log to the
 // same rotated hook.log and read stdin identically.
 const hookIo_1 = require("../hookIo");
+const fileWriteCanon_1 = require("../fileWriteCanon");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -163,36 +168,135 @@ function mapClaudeToolPayload(payload) {
             payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
         };
     }
-    // Claude Code, VS Code Copilot, and Copilot CLI each use their own tool names
-    // for the same operations — compare case/underscore-insensitively.
-    const canon = toolName.toLowerCase().replace(/[_-]/g, '');
-    const SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
-    const READ_TOOLS = new Set(['read', 'readfile', 'view']);
-    const WRITE_TOOLS = new Set([
-        'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
-        'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile',
-    ]);
-    if (SHELL_TOOLS.has(canon)) {
+    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
+    // permission flow handle them.
+    return mapBuiltinToolPayload(toolName, input, payload) ?? { event: 'ignore', payload };
+}
+// ---------------------------------------------------------------------------
+// Built-in IDE tools — ONE taxonomy for every client.
+//
+// Cursor, Claude Code, VS Code Copilot and Copilot CLI each name the same three
+// primitive actions differently (Cursor `Write`, Claude `Edit`, VS Code
+// `replaceStringInFile`; Cursor `Shell`, Claude `Bash`, VS Code `runInTerminal`).
+// They also ship different payload shapes for a file edit: Claude sends the
+// old/new strings, Cursor's `Write` and MCP `write_file` send the WHOLE resulting
+// file. If those shapes reach the policy engine as-is, the same developer action
+// gets a different verdict per client — and a whole-file write is judged as if
+// the agent were sending the entire file somewhere, so a credential-shaped
+// literal that has sat in a test fixture for years blocks every edit of that file.
+//
+// This layer canonicalizes BEFORE the engine ("capture -> canonicalize ->
+// decide -> enforce"): a file edit is `edit_file { path, content }` where
+// `content` is only what the edit ADDS; a command is `shell { command, cwd }`;
+// a file read is `read_file { path }`. Built-ins with no enforcement surface
+// (search, task, web) are ignored. Nothing here decides anything.
+// ---------------------------------------------------------------------------
+const BUILTIN_SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
+const BUILTIN_READ_TOOLS = new Set(['read', 'readfile', 'view']);
+const BUILTIN_WRITE_TOOLS = new Set([
+    'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
+    'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
+]);
+/**
+ * Built-ins that never touch a file, a command, a server or the outside world —
+ * nothing to enforce. Web fetch / web search are deliberately NOT here: they
+ * are INGRESS for the taint ledger (untrusted content entering the session)
+ * and keep flowing through the MCP path exactly as before.
+ */
+const BUILTIN_PASSIVE_TOOLS = new Set([
+    'grep', 'glob', 'ls', 'listdir', 'codebasesearch', 'semanticsearch',
+    'task', 'todowrite', 'readlints', 'switchmode', 'askquestion', 'sendtouser', 'awaitshell',
+    'getdynamictools',
+]);
+function canonicalBuiltinToolName(toolName) {
+    return (0, fileWriteCanon_1.canonicalToolName)(toolName);
+}
+/**
+ * Map a built-in IDE tool (any client) onto our event taxonomy. Returns null
+ * for a tool name this layer does not recognize so the caller keeps its own
+ * default (Claude: ignore; Cursor: treat as an MCP tool).
+ */
+function mapBuiltinToolPayload(toolName, input, payload) {
+    const canon = canonicalBuiltinToolName(toolName);
+    if (BUILTIN_SHELL_TOOLS.has(canon)) {
         return {
             event: 'shell',
-            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(payload.cwd) || undefined },
+            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(input.working_directory) || str(payload.cwd) || undefined },
         };
     }
-    if (READ_TOOLS.has(canon)) {
-        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) } };
+    if (BUILTIN_READ_TOOLS.has(canon)) {
+        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) || str(input.target_file) } };
     }
-    if (WRITE_TOOLS.has(canon)) {
-        const content = str(input.content) || str(input.new_string) || str(input.new_source) || str(input.code)
+    if (BUILTIN_WRITE_TOOLS.has(canon)) {
+        const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath) || str(input.target_file)
+            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        // Delta shapes first (old/new strings, edit lists): they already carry only
+        // what changes. Whole-file shapes (`content`, `contents`, `code`,
+        // `new_source`) are reduced to the lines they add.
+        const delta = str(input.new_string) || str(input.new_str) || str(input.new_text)
             || (Array.isArray(input.edits)
-                ? input.edits.map((e) => str(e?.new_string) || str(e?.content)).filter(Boolean).join('\n')
+                ? input.edits.map((e) => str(e?.new_string) || str(e?.new_text) || str(e?.newText) || str(e?.content)).filter(Boolean).join('\n')
                 : '');
-        const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath)
-            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        const whole = str(input.content) || str(input.contents) || str(input.new_source) || str(input.code);
+        const content = delta || (0, fileWriteCanon_1.newContentOnly)(filePath || undefined, whole);
         return { event: 'file', payload: { ...payload, file_path: filePath, content } };
     }
-    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
-    // permission flow handle them.
-    return { event: 'ignore', payload };
+    if (BUILTIN_PASSIVE_TOOLS.has(canon))
+        return { event: 'ignore', payload };
+    return null;
+}
+/**
+ * Cursor delivers its OWN built-in tools (Shell / Read / Write / Grep / …)
+ * through the same execution hook as MCP servers, with `tool_use_id` + no
+ * server identity (`mcp_server_name` / `url` / `command` are MCP-only). Route
+ * them through the shared taxonomy so an IDE edit is a FILE action, a command
+ * is a SHELL action, and neither is ever judged as an unknown MCP tool.
+ *
+ * Shell is dropped here on purpose: Cursor also fires `beforeShellExecution`
+ * for the same command, which is the authoritative shell surface — evaluating
+ * it twice produced two (sometimes different) verdicts for one action.
+ */
+function normalizeCursorBuiltinTool(payload) {
+    const toolName = str(payload.tool_name);
+    if (!toolName)
+        return null;
+    if (str(payload.mcp_server_name) || str(payload.server_name) || str(payload.mcp_server_url) || str(payload.url) || str(payload.command))
+        return null;
+    if (toolName.startsWith('mcp__') || toolName.startsWith('MCP:'))
+        return null;
+    let toolInput = payload.tool_input;
+    if (typeof toolInput === 'string') {
+        const trimmed = toolInput.trim();
+        if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+            try {
+                toolInput = JSON.parse(trimmed);
+            }
+            catch { /* keep raw */ }
+        }
+    }
+    const input = (toolInput && typeof toolInput === 'object' ? toolInput : {});
+    const mapped = mapBuiltinToolPayload(toolName, input, payload);
+    if (!mapped)
+        return null;
+    if (mapped.event === 'shell')
+        return { event: 'ignore', payload };
+    return mapped;
+}
+/**
+ * Cursor-format entry: infer the event from the `--event` flag / payload shape,
+ * then route Cursor built-in tools through the shared taxonomy. Exported so the
+ * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
+ */
+function canonicalizeCursorPayload(argEvent, payload) {
+    const event = inferEvent(argEvent, payload);
+    if (event !== 'mcp')
+        return { event, payload, ignore: false };
+    const builtin = normalizeCursorBuiltinTool(payload);
+    if (!builtin)
+        return { event, payload, ignore: false };
+    if (builtin.event === 'ignore')
+        return { event: 'unknown', payload, ignore: true };
+    return { event: builtin.event, payload: builtin.payload, ignore: false };
 }
 /**
  * Which AI client invoked a Claude-format hook. Claude Code sets CLAUDECODE=1;
@@ -298,7 +402,8 @@ function buildToolCall(event, p) {
                 }
             }
             const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
-            return { toolName, toolArgs };
+            // MCP filesystem servers write whole files; judge only what the write adds.
+            return { toolName, toolArgs: (0, fileWriteCanon_1.canonicalizeFileWriteArgs)(toolName, toolArgs) };
         }
         case 'file': {
             const filePath = str(p.file_path) || str(p.path);
@@ -1229,7 +1334,10 @@ async function hookCommandInner(args, config, io) {
         }
     }
     else {
-        event = inferEvent(args.event, payload);
+        const cursor = canonicalizeCursorPayload(args.event, payload);
+        event = cursor.event;
+        payload = cursor.payload;
+        ignoreEvent = cursor.ignore;
     }
     (0, hookIo_1.dbg)({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
         isTTY, rawLen: raw.length, ...(hookIo_1.HOOK_DEBUG_VERBOSE ? { rawPreview: raw.slice(0, 300) } : {}), stdinErr, parseErr,

package/dist/commands/mcpGateway.js

@@ -62,6 +62,7 @@ const runtimeConfig_1 = require("../runtimeConfig");
 const sessionLimits_1 = require("../sessionLimits");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
+const fileWriteCanon_1 = require("../fileWriteCanon");
 const blockExplanation_1 = require("../blockExplanation");
 const distress_1 = require("../distress");
 const policyGateHealth_1 = require("../policyGateHealth");
@@ -1092,7 +1093,12 @@ class McpGatewayServer {
         const toolName = String(params.name || '');
         if (!toolName)
             throw new Error('Missing MCP tool name.');
-        const toolArgs = params.arguments && typeof params.arguments === 'object' ? params.arguments : {};
+        // What the server receives is untouched (`forwardArgs`). What the policy
+        // decision sees is the canonical action: a whole-file write is reduced to
+        // the lines it adds so a secret already sitting in the file never blocks
+        // editing it (see fileWriteCanon.ts).
+        const forwardArgs = params.arguments && typeof params.arguments === 'object' ? params.arguments : {};
+        const toolArgs = (0, fileWriteCanon_1.canonicalizeFileWriteArgs)(toolName, forwardArgs);
         (0, telemetry_1.setVerdictToolArgs)(toolArgs);
         let approvalActionId;
         let operation = typeof params.operation === 'string' && params.operation.trim() ? params.operation.trim() : undefined;
@@ -1528,7 +1534,7 @@ class McpGatewayServer {
                 }
             }
             downstreamAttempted = true;
-            let rawResult = await this.downstream.callTool(toolName, toolArgs);
+            let rawResult = await this.downstream.callTool(toolName, forwardArgs);
             downstreamRan = true;
             downstreamResult = rawResult;
             // Response-side events must measure our scanning overhead, not the
@@ -1707,7 +1713,7 @@ class McpGatewayServer {
             if (!isBlockError(error) && !downstreamAttempted) {
                 // Pre-call bug: forward the tool call now (exactly once).
                 try {
-                    const recovered = await this.downstream.callTool(toolName, toolArgs);
+                    const recovered = await this.downstream.callTool(toolName, forwardArgs);
                     try {
                         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation, reason: `gateway error failed open (pre-call): ${message.slice(0, 200)}`, offlineEnforced: true });
                         (0, telemetry_1.triggerFlush)(false);

package/dist/fileWriteCanon.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Canonicalization of FILE WRITES before any policy decision.
+ *
+ * Clients ship a file edit in two shapes: a delta (Claude `Edit` old/new
+ * strings, Cursor `afterFileEdit` edits) or the WHOLE resulting file (Cursor's
+ * `Write`, MCP filesystem `write_file`, VS Code `createFile`). Judging the whole
+ * file as "tool arguments" means a credential-shaped literal that has sat in a
+ * test fixture for years blocks every edit of that file, in every policy that
+ * looks at `toolArgs.containsSecret` — and the verdict differs per client for
+ * the same developer action.
+ *
+ * `newContentOnly` reduces a whole-file write to the lines it ADDS relative to
+ * the file on disk, which is exactly what the delta shapes already carry. Every
+ * client then yields the identical canonical action `edit_file { path, content }`.
+ * Deterministic, reads only the target path, decides nothing.
+ */
+/** Largest on-disk file we diff against (bigger = treat all content as new). */
+export declare const DELTA_MAX_FILE_BYTES: number;
+export declare function canonicalToolName(toolName: string): string;
+export declare function newContentOnly(filePath: string | undefined, content: string): string;
+/**
+ * For a whole-file write tool (MCP `write_file`, …) with `{ path, content }`
+ * arguments, replace `content` with only the added lines. Any other tool or
+ * shape is returned untouched (same object identity), so callers can apply it
+ * unconditionally.
+ */
+export declare function canonicalizeFileWriteArgs(toolName: string, args: Record<string, unknown>): Record<string, unknown>;

package/dist/fileWriteCanon.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELTA_MAX_FILE_BYTES = void 0;
+exports.canonicalToolName = canonicalToolName;
+exports.newContentOnly = newContentOnly;
+exports.canonicalizeFileWriteArgs = canonicalizeFileWriteArgs;
+const fs = __importStar(require("fs"));
+/**
+ * Canonicalization of FILE WRITES before any policy decision.
+ *
+ * Clients ship a file edit in two shapes: a delta (Claude `Edit` old/new
+ * strings, Cursor `afterFileEdit` edits) or the WHOLE resulting file (Cursor's
+ * `Write`, MCP filesystem `write_file`, VS Code `createFile`). Judging the whole
+ * file as "tool arguments" means a credential-shaped literal that has sat in a
+ * test fixture for years blocks every edit of that file, in every policy that
+ * looks at `toolArgs.containsSecret` — and the verdict differs per client for
+ * the same developer action.
+ *
+ * `newContentOnly` reduces a whole-file write to the lines it ADDS relative to
+ * the file on disk, which is exactly what the delta shapes already carry. Every
+ * client then yields the identical canonical action `edit_file { path, content }`.
+ * Deterministic, reads only the target path, decides nothing.
+ */
+/** Largest on-disk file we diff against (bigger = treat all content as new). */
+exports.DELTA_MAX_FILE_BYTES = 8 * 1024 * 1024;
+/** MCP / IDE tool names (case- and separator-insensitive) that write a whole file. */
+const WHOLE_FILE_WRITE_TOOLS = new Set(['writefile', 'createfile', 'write', 'putfile', 'savefile', 'createorupdatefile']);
+function canonicalToolName(toolName) {
+    return toolName.toLowerCase().replace(/[_-]/g, '');
+}
+function newContentOnly(filePath, content) {
+    if (!filePath || !content)
+        return content;
+    let existing;
+    try {
+        const stat = fs.statSync(filePath);
+        if (!stat.isFile() || stat.size > exports.DELTA_MAX_FILE_BYTES)
+            return content;
+        existing = fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return content; // new file (or unreadable) — everything is new
+    }
+    if (existing === content)
+        return '';
+    const known = new Set(existing.split(/\r?\n/).map(line => line.trim()).filter(Boolean));
+    const added = content.split(/\r?\n/).filter(line => {
+        const t = line.trim();
+        return t && !known.has(t);
+    });
+    return added.join('\n');
+}
+/**
+ * For a whole-file write tool (MCP `write_file`, …) with `{ path, content }`
+ * arguments, replace `content` with only the added lines. Any other tool or
+ * shape is returned untouched (same object identity), so callers can apply it
+ * unconditionally.
+ */
+function canonicalizeFileWriteArgs(toolName, args) {
+    if (!WHOLE_FILE_WRITE_TOOLS.has(canonicalToolName(toolName)))
+        return args;
+    const filePath = typeof args.path === 'string' ? args.path
+        : typeof args.file_path === 'string' ? args.file_path
+            : typeof args.filePath === 'string' ? args.filePath
+                : undefined;
+    const contentKey = typeof args.content === 'string' ? 'content' : typeof args.contents === 'string' ? 'contents' : undefined;
+    if (!filePath || !contentKey)
+        return args;
+    const whole = args[contentKey];
+    const delta = newContentOnly(filePath, whole);
+    if (delta === whole)
+        return args;
+    return { ...args, [contentKey]: delta };
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.30.0"
+  "version": "1.31.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -87,6 +87,8 @@
     "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
     "test:s4u-migration": "npm run build && node scripts/test-s4u-task-migration.js",
     "test:block-explanation": "npm run build && node scripts/test-block-explanation.js",
+    "test:file-write-canon": "npm run build && node scripts/test-file-write-canon.js",
+    "test:agent-ci-gate": "npm run build && node scripts/test-agent-ci-gate.js",
     "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",