feat: add Claude and Cursor hook support

[jy-tan]

Summary

Add hook-based shell wrapping for Claude Code and Cursor so Fence can sandbox shell tool calls even when the agent is running outside Fence. The hook helpers share one shell-hook core that resolves policy from the tool cwd, denies blocked commands before rewrite, and avoids nested sandbox relaunches when Fence is already active.

Changes

• Add fence hooks print, install, and uninstall commands plus hidden --claude-pre-tool-use and --cursor-pre-tool-use helpers
• Add thin Claude and Cursor JSON adapters around a shared shell-hook core for shell tool evaluation and command rewriting
• Preflight shell commands with Fence policy using payload cwd plus optional --settings or --template overrides, and return hook-level denies for blocked commands
• Accept either Claude or Cursor hook payloads so Cursor can reuse Claude hook settings when present
• Preserve direct policy error messages for blocked commands instead of prefixing them with wrap failures
• Document hook-based usage for Claude and Cursor and add regression tests for wrapping, deny behavior, pinned policy, cwd handling, and cross-payload compatibility

[cubic-dev-ai]

2 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/fence/hooks_runtime.go">

<violation number="1" location="cmd/fence/hooks_runtime.go:212">
P1: Security bypass: `isPureCDCommand` does not check for `$` or backtick command substitution. A command like `cd $(malicious)` is treated as a harmless cd and skips both the deny check and sandbox wrapping entirely.</violation>
</file>

<file name="cmd/fence/hooks_doc.go">

<violation number="1" location="cmd/fence/hooks_doc.go:184">
P2: Hook command detection uses substring matching, which can incorrectly remove or overwrite unrelated hook entries that happen to contain the helper flag text.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}