fullcourtdefense-cli 1.5.0 → 1.5.2

package/dist/commands/mcpGateway.d.ts

@@ -61,6 +61,7 @@ export declare function installMcpGatewayCommand(args: InstallMcpGatewayArgs, co
 export interface ProtectAllArgs extends McpGatewayArgs {
     dryRun?: string;
     config?: string;
+    clients?: string;
 }
 export declare function protectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
 export declare function unprotectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/mcpGateway.js

@@ -942,6 +942,24 @@ async function installMcpGatewayCommand(args, config) {
         console.log('Add --upload to refresh AI Fleet after install.');
     }
 }
+/** Map a high-level client to the discovery clientKey(s) its config files use. */
+const AGENT_TO_CLIENT_KEYS = {
+    cursor: ['cursor'],
+    'claude-code': ['claude_code'],
+    'claude-desktop': ['claude_desktop'],
+    codex: ['codex'],
+    'gemini-cli': ['gemini_cli'],
+    windsurf: ['windsurf'],
+    vscode: ['vscode'],
+};
+/** Resolve the optional --clients filter into a set of clientKeys, or undefined for "all". */
+function resolveProtectClientKeys(clients) {
+    const raw = (clients || '').trim().toLowerCase();
+    if (!raw || raw === 'auto' || raw === 'all')
+        return undefined; // no filter — process every client
+    const selection = parseClientList(clients);
+    return new Set(selection.flatMap(client => AGENT_TO_CLIENT_KEYS[client] || []));
+}
 const CLIENT_KEY_TO_AGENT = {
     cursor: 'cursor',
     claude_code: 'claude-code',
@@ -1035,7 +1053,7 @@ function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
             }
             const downstreamCommand = entry.command;
             const downstreamArgs = Array.isArray(entry.args) ? entry.args.map(String) : [];
-            const perServer = { ...gatewayConfig, agentName: perServerAgentName(gatewayConfig.developerName, agentClient, name) };
+            const perServer = { ...gatewayConfig, agentClient, agentName: perServerAgentName(gatewayConfig.developerName, agentClient, name) };
             const wrappedArgs = buildGatewayCommandArgs(perServer, downstreamCommand, downstreamArgs, INSTALL_GATEWAY_ARGS);
             entry.command = nodeExe;
             entry.args = wrappedArgs;
@@ -1087,30 +1105,47 @@ function unwrapJsonConfigFile(file, dryRun) {
     }
     return { restored };
 }
-/** Parse a single-line TOML scalar string value: command = "x". */
+/** Parse a single-line TOML scalar string value: command = "x" or command = 'x'. */
 function parseTomlInlineString(line) {
-    const m = line.match(/=\s*"((?:[^"\\]|\\.)*)"/);
-    if (!m)
-        return undefined;
-    try {
-        return JSON.parse(`"${m[1]}"`);
-    }
-    catch {
-        return m[1];
+    const rhs = line.slice(line.indexOf('=') + 1).trim();
+    const basic = rhs.match(/^"((?:[^"\\]|\\.)*)"/);
+    if (basic) {
+        try {
+            return JSON.parse(`"${basic[1]}"`);
+        }
+        catch {
+            return basic[1];
+        }
     }
+    const literal = rhs.match(/^'([^']*)'/); // TOML literal string — no escapes
+    if (literal)
+        return literal[1];
+    return undefined;
 }
-/** Parse a single-line TOML string array: args = ["a", "b"]. */
+/** Parse a single-line TOML string array: args = ["a", 'b'] (mixed quotes ok). */
 function parseTomlInlineStringArray(line) {
-    const m = line.match(/=\s*(\[.*\])\s*$/);
-    if (!m)
-        return undefined;
-    try {
-        const parsed = JSON.parse(m[1]);
-        if (Array.isArray(parsed))
-            return parsed.map(String);
+    const rhs = line.slice(line.indexOf('=') + 1).trim();
+    if (!rhs.startsWith('[') || !rhs.endsWith(']'))
+        return undefined; // multi-line / not an inline array
+    const inner = rhs.slice(1, -1).trim();
+    if (inner === '')
+        return [];
+    const out = [];
+    const re = /"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
+    let match;
+    while ((match = re.exec(inner)) !== null) {
+        if (match[1] !== undefined) {
+            try {
+                out.push(JSON.parse(`"${match[1]}"`));
+            }
+            catch {
+                out.push(match[1]);
+            }
+        }
+        else
+            out.push(match[2] ?? '');
     }
-    catch { /* not single-line */ }
-    return undefined;
+    return out;
 }
 function tomlStringArrayLiteral(values) {
     return `[${values.map(v => JSON.stringify(v)).join(', ')}]`;
@@ -1169,7 +1204,7 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
                 stats.skippedManaged.push(section.name);
                 continue;
             }
-            const perServer = { ...gatewayConfig, agentName: perServerAgentName(gatewayConfig.developerName, 'codex', section.name) };
+            const perServer = { ...gatewayConfig, agentClient: 'codex', agentName: perServerAgentName(gatewayConfig.developerName, 'codex', section.name) };
             const wrappedArgs = buildGatewayCommandArgs(perServer, section.command, section.args || [], INSTALL_GATEWAY_ARGS);
             const indent = lines[section.cmdLine].match(/^\s*/)?.[0] || '';
             lines[section.cmdLine] = `${indent}command = ${JSON.stringify(nodeExe)}`;
@@ -1201,24 +1236,29 @@ function transformCodexToml(file, mode, gatewayConfig, dryRun) {
     }
     return stats;
 }
-function protectAllTargetFiles(extra) {
+function protectAllTargetFiles(extra, allowedClientKeys) {
     const cwd = process.cwd();
     const seen = new Set();
+    const allow = (clientKey) => !allowedClientKeys || allowedClientKeys.has(clientKey);
     const files = [];
     for (const candidate of (0, discoverPaths_1.candidateConfigPaths)(cwd, extra)) {
         const key = path.resolve(candidate.path).toLowerCase();
         if (seen.has(key))
             continue;
+        if (!allow(candidate.clientKey))
+            continue;
         if (!fs.existsSync(candidate.path))
             continue;
         seen.add(key);
         files.push(candidate);
     }
-    for (const target of (0, discoverPaths_1.claudeDesktopInstallTargets)()) {
-        const key = path.resolve(target.file).toLowerCase();
-        if (target.exists && !seen.has(key)) {
-            seen.add(key);
-            files.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+    if (allow('claude_desktop')) {
+        for (const target of (0, discoverPaths_1.claudeDesktopInstallTargets)()) {
+            const key = path.resolve(target.file).toLowerCase();
+            if (target.exists && !seen.has(key)) {
+                seen.add(key);
+                files.push({ path: target.file, source: target.source, clientKey: 'claude_desktop' });
+            }
         }
     }
     return files;
@@ -1227,11 +1267,14 @@ async function protectAllCommand(args, config) {
     (0, config_1.requireCliSetup)(config, { shieldId: args.shieldId, shieldKey: args.shieldKey, apiUrl: args.apiUrl }, { requireOrganizationId: false });
     const gatewayConfig = resolveGatewayConfig(args, config);
     const dryRun = args.dryRun === 'true';
-    const files = protectAllTargetFiles(args.config);
+    const allowedClientKeys = resolveProtectClientKeys(args.clients);
+    const files = protectAllTargetFiles(args.config, allowedClientKeys);
     console.log('\n\x1b[1m\x1b[36mFullCourtDefense — protect every MCP server in every client\x1b[0m');
     console.log(`\x1b[2mRuntime identity: ${gatewayConfig.developerName}  |  Shield: ${gatewayConfig.shieldId}${dryRun ? '  |  DRY RUN' : ''}\x1b[0m\n`);
     if (files.length === 0) {
-        console.log('No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
+        console.log(allowedClientKeys
+            ? 'No matching client config files found for the requested --clients. Try without --clients, or pick a client that is installed.'
+            : 'No MCP client config files found on this machine. Configure an MCP server in any client, then re-run.');
         return;
     }
     let totalWrapped = 0;
@@ -1268,7 +1311,8 @@ async function protectAllCommand(args, config) {
 }
 async function unprotectAllCommand(args, config) {
     const dryRun = args.dryRun === 'true';
-    const files = protectAllTargetFiles(args.config);
+    const allowedClientKeys = resolveProtectClientKeys(args.clients);
+    const files = protectAllTargetFiles(args.config, allowedClientKeys);
     let gatewayConfig;
     try {
         gatewayConfig = resolveGatewayConfig(args, config);

package/dist/index.js

@@ -128,8 +128,11 @@ function printHelp() {
                 (Cursor, Claude Code/Desktop, Codex, Gemini, Windsurf, VS Code)
                 and wrap each through the Shield proxy — no --mcp-command needed.
                 Enforces your org Action Policies on every tool. --dry-run to preview.
+                Per-tool: --clients cursor (or claude-code, claude-desktop, codex,
+                gemini-cli, windsurf, vscode; comma-separated). Default: all tools.
     unprotect-all
                 Reverse protect-all: restore every server to its original command.
+                Also supports --clients to target one tool, and --dry-run.
     install-mcp-gateway
                 Install MCP gateway into selected clients (--clients all for every tool).
     install-cursor-mcp-gateway
@@ -511,6 +514,7 @@ async function main() {
                 ...buildGatewayArgs(),
                 dryRun: flags['dry-run'],
                 config: flags.config,
+                clients: flags.clients,
             };
             await (0, mcpGateway_1.protectAllCommand)(args, config);
             break;
@@ -521,6 +525,7 @@ async function main() {
                 ...buildGatewayArgs(),
                 dryRun: flags['dry-run'],
                 config: flags.config,
+                clients: flags.clients,
             };
             await (0, mcpGateway_1.unprotectAllCommand)(args, config);
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.5.0"
+  "version": "1.5.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {