fullcourtdefense-cli 1.6.4 → 1.6.6

package/dist/commands/hook.js

@@ -222,6 +222,40 @@ function developerId() {
         return 'unknown-developer';
     }
 }
+/**
+ * Normalize an identity component — MUST stay byte-for-byte identical to the MCP
+ * gateway's `safeIdentityPart` (mcpGateway.ts) so the hook and the gateway build
+ * the SAME per-server agent identity for the same server.
+ */
+function safeIdentityPart(value) {
+    return value
+        .trim()
+        .replace(/@.*$/, '')
+        .replace(/[^a-zA-Z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .toLowerCase() || 'local-user';
+}
+/** Extract the MCP server name Cursor reports for a beforeMCPExecution payload. */
+function mcpServerName(p) {
+    return str(p.mcp_server_name) || str(p.server_name) || str(p.serverName) || str(p.mcpServer) || undefined;
+}
+/**
+ * Runtime agent identity for a tool call. For MCP calls we use a RUNTIME-AGNOSTIC
+ * per-server identity (`<developer>-<server>`) — the client (cursor/codex/claude/...) is
+ * intentionally NOT part of the identity, because the same logical agent (the MCP server)
+ * is the same agent no matter which IDE/client invokes it. This mirrors the gateway's
+ * `perServerAgentName`, so ONE per-agent policy matches the same server across every runtime.
+ * The client is still reported separately as `agentClient` metadata for optional per-runtime
+ * constraints. Non-MCP events keep the collapsed per-developer IDE-runtime identity.
+ */
+function agentNameForCall(event, p) {
+    if (event === 'mcp') {
+        const server = mcpServerName(p);
+        if (server)
+            return `${safeIdentityPart(developerId())}-${safeIdentityPart(server)}`;
+    }
+    return `cursor-${developerId()}`;
+}
 /** Cursor conversation/session id when present, else a stable per-machine id. */
 function sessionId(p) {
     const fromPayload = p.conversation_id || p.conversationId || p.session_id || p.sessionId;
@@ -351,12 +385,16 @@ async function enforceActionPolicy(ctx) {
             headers,
             body: JSON.stringify({
                 shieldId,
-                agentName: `cursor-${developerId()}`,
+                // For MCP calls this mirrors the gateway's runtime-agnostic per-server identity
+                // (`<developer>-<server>`), so ONE per-agent policy matches the same server on the
+                // gateway path AND this in-IDE hook path, across every client/runtime.
+                agentName: agentNameForCall(event, payload),
                 toolName: call.toolName,
                 toolArgs: call.toolArgs,
                 argsSummary: summarizeToolCall(call.toolName, call.toolArgs),
                 sessionId: sessionId(payload),
                 source: 'cursor_hook',
+                ...(event === 'mcp' && mcpServerName(payload) ? { mcpServer: mcpServerName(payload) } : {}),
                 ...machineMetadata(),
             }),
             signal: controller.signal,

package/dist/commands/mcpGateway.js

@@ -1022,8 +1022,13 @@ function backupFile(file) {
     }
     catch { /* best effort */ }
 }
-function perServerAgentName(developerName, agentClient, serverName) {
-    return `${safeIdentityPart(developerName)}-${agentClient}-${safeIdentityPart(serverName)}`;
+// RUNTIME-AGNOSTIC per-server agent identity: `<developer>-<server>`. The client
+// (cursor/codex/claude/...) is deliberately excluded — the same MCP server is the same
+// logical agent regardless of which IDE/runtime invokes it, so ONE per-agent policy applies
+// everywhere. The client is still carried separately as `agentClient` metadata (see GatewayConfig)
+// for optional per-runtime constraints. `agentClient` is kept as a param for signature stability.
+function perServerAgentName(developerName, _agentClient, serverName) {
+    return `${safeIdentityPart(developerName)}-${safeIdentityPart(serverName)}`;
 }
 function wrapJsonConfigFile(file, gatewayConfig, agentClient, dryRun) {
     const stats = newWrapStats();

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.4"
+  "version": "1.6.6"
 }

package/package.json

@@ -1,42 +1,42 @@
-{
-  "name": "fullcourtdefense-cli",
-  "version": "1.6.4",
-  "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
-  "main": "dist/index.js",
-  "bin": {
-    "fullcourtdefense": "dist/index.js",
-    "fcd": "dist/index.js",
-    "botguard": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc && node scripts/copy-attack-corpus.js",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "llm",
-    "security",
-    "guardrails",
-    "ai-safety",
-    "prompt-injection",
-    "cli",
-    "red-teaming",
-    "owasp",
-    "mcp",
-    "rag"
-  ],
-  "license": "MIT",
-  "devDependencies": {
-    "@types/node": "^25.3.0",
-    "typescript": "^5.3.0"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "yaml": "^2.8.4"
-  }
-}
+{
+  "name": "fullcourtdefense-cli",
+  "version": "1.6.6",
+  "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
+  "main": "dist/index.js",
+  "bin": {
+    "fullcourtdefense": "dist/index.js",
+    "fcd": "dist/index.js",
+    "botguard": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc && node scripts/copy-attack-corpus.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "llm",
+    "security",
+    "guardrails",
+    "ai-safety",
+    "prompt-injection",
+    "cli",
+    "red-teaming",
+    "owasp",
+    "mcp",
+    "rag"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^25.3.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "yaml": "^2.8.4"
+  }
+}