fullcourtdefense-cli 1.6.2 → 1.6.4

package/dist/commands/hook.js

@@ -135,7 +135,21 @@ function buildToolCall(event, p) {
         }
         case 'mcp': {
             const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
-            const rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            let rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            // Cursor sends `tool_input` as a JSON-ENCODED STRING (e.g. '{"command":"DROP ..."}').
+            // Parse it so the real args (command/query/sql/...) are visible to the policy engine.
+            // Without this, args collapse to { value: "<json string>" }, no operation verb is
+            // inferred, and the operation falls back to the tool NAME — so a tool called
+            // `drop_production_database` would match a DROP rule for EVERY command (SELECT included).
+            if (typeof rawInput === 'string') {
+                const trimmed = rawInput.trim();
+                if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+                    try {
+                        rawInput = JSON.parse(trimmed);
+                    }
+                    catch { /* keep the raw string */ }
+                }
+            }
             const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
             return { toolName, toolArgs };
         }
@@ -177,6 +191,9 @@ function safeJson(v) {
         return String(v);
     }
 }
+function degradedAllowMessage(event, detail) {
+    return `FullCourtDefense policy gate unavailable; allowed ${event} in degraded mode. ${detail}`.trim();
+}
 /** Per-event attribution that maps onto the existing Shield runtime headers (prompt path). */
 function attributionFor(event, p) {
     const h = {};
@@ -232,7 +249,7 @@ async function hookCommand(args, config) {
     const shadow = args.shadow === 'true';
     const failClosed = args.failClosed === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
-    const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
+    const approvalMode = args.approvalMode === 'wait' ? 'wait' : 'block';
     const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000;
     const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
     const creds = (0, config_1.resolveCliCredentials)(config, {
@@ -316,7 +333,7 @@ async function hookCommand(args, config) {
     respond(false);
 }
 async function enforceActionPolicy(ctx) {
-    const { event, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
+    const { event, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond } = ctx;
     const call = buildToolCall(event, payload);
     if (!call) {
         respond(false);
@@ -347,20 +364,20 @@ async function enforceActionPolicy(ctx) {
         clearTimeout(timer);
         if (!resp.ok) {
             dbg({ phase: 'policy_http_error', event, status: resp.status });
-            respond(failClosed, failClosed ? `FullCourtDefense policy gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense policy gate returned HTTP ${resp.status}.`);
+            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
             return;
         }
         const body = await resp.json().catch(() => ({}));
         if (!body.success || !body.data) {
             dbg({ phase: 'policy_no_data', event, error: body.error });
-            respond(failClosed, failClosed ? 'FullCourtDefense policy gate error — blocked by fail-closed policy.' : undefined, body.error);
+            respond(false, undefined, degradedAllowMessage(event, body.error ? `Backend error: ${body.error}` : 'Backend returned no policy data.'));
             return;
         }
         result = body.data;
     }
     catch (err) {
         dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err) });
-        respond(failClosed, failClosed ? 'FullCourtDefense policy gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
         return;
     }
     const reason = result.actionPolicy?.reason
@@ -453,7 +470,8 @@ async function enforceShieldText(ctx) {
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            respond(failClosed, failClosed ? `FullCourtDefense gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense gate returned HTTP ${resp.status}.`);
+            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
+            return;
         }
         const data = await resp.json().catch(() => ({}));
         const sh = (data._shield || {});
@@ -468,6 +486,6 @@ async function enforceShieldText(ctx) {
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
-        respond(failClosed, failClosed ? 'FullCourtDefense gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
     }
 }

package/dist/commands/installCursorHook.js

@@ -123,6 +123,16 @@ async function installCursorHookCommand(args, config) {
     });
     const credFile = ensureHomeShield(creds);
     const json = readHooksJson(file);
+    // Clear all previous FullCourtDefense-managed hooks first. This prevents old
+    // prompt/read/file entries from surviving when the installer narrows the event set.
+    for (const key of Object.keys(json.hooks)) {
+        const list = Array.isArray(json.hooks[key]) ? json.hooks[key] : [];
+        const kept = list.filter((x) => !isManaged(x));
+        if (kept.length)
+            json.hooks[key] = kept;
+        else
+            delete json.hooks[key];
+    }
     for (const e of events) {
         const { hookKey, flag, failClosedDefault, timeoutSec } = EVENT_MAP[e];
         const failClosed = e === 'prompt' ? false : (args.failClosed !== undefined ? args.failClosed === 'true' : failClosedDefault);
@@ -133,9 +143,7 @@ async function installCursorHookCommand(args, config) {
         if (failClosed)
             entry.failClosed = true;
         const list = Array.isArray(json.hooks[hookKey]) ? json.hooks[hookKey] : [];
-        // Replace any prior FullCourtDefense-managed entry; preserve the user's other hooks.
-        const preserved = list.filter((x) => !isManaged(x));
-        json.hooks[hookKey] = [...preserved, entry];
+        json.hooks[hookKey] = [...list, entry];
     }
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n', 'utf8');

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.2"
+  "version": "1.6.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {