fullcourtdefense-cli 1.6.3 → 1.6.5

package/dist/commands/hook.js

@@ -135,7 +135,21 @@ function buildToolCall(event, p) {
         }
         case 'mcp': {
             const toolName = str(p.tool_name) || str(p.toolName) || str(p.name) || 'mcp';
-            const rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            let rawInput = p.tool_input ?? p.arguments ?? p.input ?? p.params;
+            // Cursor sends `tool_input` as a JSON-ENCODED STRING (e.g. '{"command":"DROP ..."}').
+            // Parse it so the real args (command/query/sql/...) are visible to the policy engine.
+            // Without this, args collapse to { value: "<json string>" }, no operation verb is
+            // inferred, and the operation falls back to the tool NAME — so a tool called
+            // `drop_production_database` would match a DROP rule for EVERY command (SELECT included).
+            if (typeof rawInput === 'string') {
+                const trimmed = rawInput.trim();
+                if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+                    try {
+                        rawInput = JSON.parse(trimmed);
+                    }
+                    catch { /* keep the raw string */ }
+                }
+            }
             const toolArgs = rawInput && typeof rawInput === 'object' ? rawInput : { value: rawInput };
             return { toolName, toolArgs };
         }
@@ -177,6 +191,9 @@ function safeJson(v) {
         return String(v);
     }
 }
+function degradedAllowMessage(event, detail) {
+    return `FullCourtDefense policy gate unavailable; allowed ${event} in degraded mode. ${detail}`.trim();
+}
 /** Per-event attribution that maps onto the existing Shield runtime headers (prompt path). */
 function attributionFor(event, p) {
     const h = {};
@@ -205,6 +222,37 @@ function developerId() {
         return 'unknown-developer';
     }
 }
+/**
+ * Normalize an identity component — MUST stay byte-for-byte identical to the MCP
+ * gateway's `safeIdentityPart` (mcpGateway.ts) so the hook and the gateway build
+ * the SAME per-server agent identity for the same server.
+ */
+function safeIdentityPart(value) {
+    return value
+        .trim()
+        .replace(/@.*$/, '')
+        .replace(/[^a-zA-Z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .toLowerCase() || 'local-user';
+}
+/** Extract the MCP server name Cursor reports for a beforeMCPExecution payload. */
+function mcpServerName(p) {
+    return str(p.mcp_server_name) || str(p.server_name) || str(p.serverName) || str(p.mcpServer) || undefined;
+}
+/**
+ * Runtime agent identity for a tool call. For MCP calls we mirror the gateway's
+ * per-server identity (`<developer>-cursor-<server>`) so a per-agent policy created
+ * for a gateway-observed agent ALSO matches the same server when it flows through
+ * the in-IDE hook. Non-MCP events keep the collapsed per-developer identity.
+ */
+function agentNameForCall(event, p) {
+    if (event === 'mcp') {
+        const server = mcpServerName(p);
+        if (server)
+            return `${safeIdentityPart(developerId())}-cursor-${safeIdentityPart(server)}`;
+    }
+    return `cursor-${developerId()}`;
+}
 /** Cursor conversation/session id when present, else a stable per-machine id. */
 function sessionId(p) {
     const fromPayload = p.conversation_id || p.conversationId || p.session_id || p.sessionId;
@@ -232,7 +280,7 @@ async function hookCommand(args, config) {
     const shadow = args.shadow === 'true';
     const failClosed = args.failClosed === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
-    const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
+    const approvalMode = args.approvalMode === 'wait' ? 'wait' : 'block';
     const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000;
     const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
     const creds = (0, config_1.resolveCliCredentials)(config, {
@@ -316,7 +364,7 @@ async function hookCommand(args, config) {
     respond(false);
 }
 async function enforceActionPolicy(ctx) {
-    const { event, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
+    const { event, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond } = ctx;
     const call = buildToolCall(event, payload);
     if (!call) {
         respond(false);
@@ -334,12 +382,16 @@ async function enforceActionPolicy(ctx) {
             headers,
             body: JSON.stringify({
                 shieldId,
-                agentName: `cursor-${developerId()}`,
+                // For MCP calls this mirrors the gateway's per-server identity
+                // (`<developer>-cursor-<server>`), so a per-agent policy matches the same
+                // server on BOTH the gateway path and this in-IDE hook path.
+                agentName: agentNameForCall(event, payload),
                 toolName: call.toolName,
                 toolArgs: call.toolArgs,
                 argsSummary: summarizeToolCall(call.toolName, call.toolArgs),
                 sessionId: sessionId(payload),
                 source: 'cursor_hook',
+                ...(event === 'mcp' && mcpServerName(payload) ? { mcpServer: mcpServerName(payload) } : {}),
                 ...machineMetadata(),
             }),
             signal: controller.signal,
@@ -347,20 +399,20 @@ async function enforceActionPolicy(ctx) {
         clearTimeout(timer);
         if (!resp.ok) {
             dbg({ phase: 'policy_http_error', event, status: resp.status });
-            respond(failClosed, failClosed ? `FullCourtDefense policy gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense policy gate returned HTTP ${resp.status}.`);
+            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
             return;
         }
         const body = await resp.json().catch(() => ({}));
         if (!body.success || !body.data) {
             dbg({ phase: 'policy_no_data', event, error: body.error });
-            respond(failClosed, failClosed ? 'FullCourtDefense policy gate error — blocked by fail-closed policy.' : undefined, body.error);
+            respond(false, undefined, degradedAllowMessage(event, body.error ? `Backend error: ${body.error}` : 'Backend returned no policy data.'));
             return;
         }
         result = body.data;
     }
     catch (err) {
         dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err) });
-        respond(failClosed, failClosed ? 'FullCourtDefense policy gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
         return;
     }
     const reason = result.actionPolicy?.reason
@@ -453,7 +505,8 @@ async function enforceShieldText(ctx) {
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            respond(failClosed, failClosed ? `FullCourtDefense gate unavailable (HTTP ${resp.status}) — blocked by fail-closed policy.` : undefined, `FullCourtDefense gate returned HTTP ${resp.status}.`);
+            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
+            return;
         }
         const data = await resp.json().catch(() => ({}));
         const sh = (data._shield || {});
@@ -468,6 +521,6 @@ async function enforceShieldText(ctx) {
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
-        respond(failClosed, failClosed ? 'FullCourtDefense gate unreachable — blocked by fail-closed policy.' : undefined, `FullCourtDefense hook error: ${err instanceof Error ? err.message : String(err)}.`);
+        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
     }
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.3"
+  "version": "1.6.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {