fullcourtdefense-cli 1.34.1 → 1.34.2

package/dist/codexMcpIdentity.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Name dictionary, not an effective configuration or an authorization source.
+ * Include user-owned profiles conservatively: hook payloads do not identify the
+ * selected profile. Aliases shared by different names are denied, never guessed.
+ * Never consult project files unless the user configuration trusts their root.
+ */
+export declare function codexMcpServerNames(home?: string, cwd?: string): string[];
+/** Codex exposes sanitized tool namespaces. Resolve only unique configured identities. */
+export declare function resolveCodexMcpTool(tool: string, serverNames: string[]): {
+    server: string;
+    tool: string;
+} | undefined;

package/dist/codexMcpIdentity.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexMcpServerNames = codexMcpServerNames;
+exports.resolveCodexMcpTool = resolveCodexMcpTool;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const toml_1 = require("@iarna/toml");
+/** Parse config without executing commands or exposing its contents in errors. */
+function readConfig(file) {
+    try {
+        return (0, toml_1.parse)(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return {};
+        throw new Error('Cannot parse Codex configuration to resolve MCP server identity.');
+    }
+}
+/**
+ * Name dictionary, not an effective configuration or an authorization source.
+ * Include user-owned profiles conservatively: hook payloads do not identify the
+ * selected profile. Aliases shared by different names are denied, never guessed.
+ * Never consult project files unless the user configuration trusts their root.
+ */
+function codexMcpServerNames(home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), cwd = process.cwd()) {
+    const base = readConfig(path.join(home, 'config.toml'));
+    const configs = [base];
+    const system = process.platform === 'win32'
+        ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'OpenAI', 'Codex', 'config.toml')
+        : '/etc/codex/config.toml';
+    configs.push(readConfig(system));
+    let profiles = [];
+    try {
+        profiles = fs.readdirSync(home).filter(name => /^[A-Za-z0-9_-]+\.config\.toml$/.test(name));
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    for (const file of profiles) {
+        // An invalid, unselected profile is not active in Codex and cannot supply names.
+        // Selecting an invalid profile fails Codex startup itself.
+        try {
+            configs.push(readConfig(path.join(home, file)));
+        }
+        catch { /* inactive invalid profile */ }
+    }
+    const within = (root, dir) => {
+        const rel = path.relative(root, dir);
+        return rel === '' || (rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel));
+    };
+    const roots = Object.keys(base.projects || {}).filter(root => path.isAbsolute(root) && within(root, path.resolve(cwd)))
+        .sort((a, b) => b.length - a.length);
+    const trustedRoot = roots[0];
+    if (trustedRoot && base.projects[trustedRoot]?.trust_level === 'trusted') {
+        for (let dir = path.resolve(cwd); within(trustedRoot, dir); dir = path.dirname(dir)) {
+            configs.push(readConfig(path.join(dir, '.codex', 'config.toml')));
+            if (path.dirname(dir) === dir)
+                break;
+        }
+    }
+    const names = new Set();
+    for (const config of configs) {
+        if (config.mcp_servers && typeof config.mcp_servers === 'object' && !Array.isArray(config.mcp_servers)) {
+            for (const name of Object.keys(config.mcp_servers))
+                names.add(name);
+        }
+    }
+    return [...names];
+}
+/** Codex exposes sanitized tool namespaces. Resolve only unique configured identities. */
+function resolveCodexMcpTool(tool, serverNames) {
+    if (!tool.startsWith('mcp__'))
+        return undefined;
+    const matches = [...new Set(serverNames)].flatMap(server => {
+        const aliases = new Set([server, server.replace(/[^A-Za-z0-9_]/g, '_')]);
+        return [...aliases].filter(alias => tool.startsWith(`mcp__${alias}__`))
+            .map(alias => ({ server, tool: tool.slice(`mcp__${alias}__`.length) }));
+    });
+    if (matches.length > 1)
+        throw new Error('Ambiguous Codex MCP server identity; use distinct server names.');
+    if (matches.length && !matches[0].tool)
+        throw new Error('Missing Codex MCP tool name.');
+    return matches[0];
+}

package/dist/commands/hook.js

@@ -161,8 +161,11 @@ function mapClaudeToolPayload(payload) {
     // MCP tools arrive as `mcp__<server>__<tool>` (same in Claude Code and VS Code).
     if (toolName.startsWith('mcp__')) {
         const parts = toolName.split('__');
-        const server = parts[1] || 'mcp';
-        const shortTool = parts.slice(2).join('__') || toolName;
+        // A verified explicit server preserves names containing the separator itself.
+        const explicitServer = str(payload.mcp_server_name);
+        const server = explicitServer && toolName.startsWith(`mcp__${explicitServer}__`)
+            ? explicitServer : parts[1] || 'mcp';
+        const shortTool = toolName.slice(`mcp__${server}__`.length) || toolName;
         return {
             event: 'mcp',
             payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
@@ -789,6 +792,7 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     }
     const { operation, context } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
     context.toolName = call.toolName;
+    context.agentName = agentNameForCall(ctx.event, ctx.payload, ctx.client);
     (0, machineIdentity_1.stampMachineIdentityContext)(context, developerId());
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
@@ -1800,6 +1804,7 @@ async function enforceActionPolicy(ctx) {
     if (ctx.localPolicies && (ctx.localPolicies.length > 0 || localAskPending)) {
         const { operation: localOp, context: localCtx } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
         localCtx.toolName = call.toolName;
+        localCtx.agentName = agentNameForCall(event, payload, ctx.client);
         (0, machineIdentity_1.stampMachineIdentityContext)(localCtx, developerId());
         const localVerdict = (0, actionPolicyEngine_1.evaluateActionPolicies)(ctx.localPolicies, call.toolName, localOp, localCtx, (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName));
         (0, hookIo_1.dbg)({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });

package/dist/nativeHook.d.ts

@@ -4,7 +4,7 @@ export type NativeClient = 'codex' | 'gemini_cli' | 'windsurf' | 'kiro';
 type Payload = Record<string, any>;
 export declare const NATIVE_CLIENTS: NativeClient[];
 export declare function patchToolCalls(raw: Payload): Payload[];
-export declare function normalizeNativeInput(client: NativeClient, raw: Payload): Payload;
+export declare function normalizeNativeInput(client: NativeClient, raw: Payload, codexServers?: string[]): Payload;
 export declare function nativeVerdict(client: NativeClient, denied: boolean, reason?: string): {
     stdout: string;
     stderr: string;

package/dist/nativeHook.js

@@ -15,6 +15,7 @@ const runtimeConfig_1 = require("./runtimeConfig");
 const hookIo_1 = require("./hookIo");
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
+const codexMcpIdentity_1 = require("./codexMcpIdentity");
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
 function patchToolCalls(raw) {
     const patch = typeof raw.tool_input === 'string' ? raw.tool_input : String(raw.tool_input?.command || raw.tool_input?.patch || '');
@@ -37,10 +38,17 @@ function patchToolCalls(raw) {
         throw new Error('Patch contains no recognized file operations');
     return calls;
 }
-function normalizeNativeInput(client, raw) {
+function normalizeNativeInput(client, raw, codexServers = []) {
     let name = String(raw.hook_event_name || '');
     let tool = String(raw.tool_name || '');
     let input = raw.tool_input || {};
+    if (client === 'codex') {
+        const identity = (0, codexMcpIdentity_1.resolveCodexMcpTool)(tool, codexServers);
+        if (identity) {
+            tool = `mcp__${identity.server}__${identity.tool}`;
+            raw = { ...raw, mcp_server_name: identity.server };
+        }
+    }
     if (client === 'windsurf') {
         const event = String(raw.agent_action_name || '');
         const info = raw.tool_info || {};
@@ -158,7 +166,7 @@ async function evaluateNativeHook(client, raw, args, config, confirm = confirmNa
     }
     let payload;
     try {
-        payload = normalizeNativeInput(client, raw);
+        payload = normalizeNativeInput(client, raw, client === 'codex' && String(raw.tool_name || '').startsWith('mcp__') ? (0, codexMcpIdentity_1.codexMcpServerNames)() : []);
     }
     catch (error) {
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.1"
+  "version": "1.34.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.1",
+  "version": "1.34.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -118,6 +118,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
+    "@iarna/toml": "^2.2.5",
     "@napi-rs/keyring": "^1.3.0",
     "yaml": "^2.8.4"
   }