aegis-devops 0.1.3__tar.gz → 0.1.4__tar.gz

{aegis_devops-0.1.3/src/aegis_devops.egg-info → aegis_devops-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.3
+Version: 0.1.4
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -30,19 +30,34 @@ Provides-Extra: llm
 Requires-Dist: anthropic; extra == "llm"
 Dynamic: license-file
 
-# Aegis-DevOps — Policy Verifier for AI DevOps Agents
+# Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
 [![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
 
-**Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
-before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
+**Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
+ticket told them to.**
 
-**Keywords:** AI agent security · AgentOps · prompt injection · context poisoning · policy
-enforcement · policy-as-code · Kubernetes · Terraform · OPA · SRE · LLM guardrails ·
-provenance · infrastructure-as-code
+Aegis-DevOps checks every command an agent wants to run before it runs, and blocks it if your
+policy says no. A policy rule only counts if nobody has edited it since it was signed, and if
+its author was allowed to write that kind of rule. So a planted line in a Jira ticket can't
+become policy.
 
-![Aegis demo](docs/demo.gif)
+![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
+
+### Install in Claude Code
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. It also works as a CI step
+(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
+[Quick start](#quick-start).
 
 ## What it does
 
@@ -92,19 +107,7 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
-### In your coding agent
-
-Aegis can check every shell command Claude Code, Codex, GitHub Copilot (CLI and VS Code) or
-Cursor wants to run, before it runs. In Claude Code:
-
-```bash
-pip install aegis-devops && aegis init .aegis
-claude plugin marketplace add moneytool/aegis-devops
-claude plugin install aegis-devops@aegis-devops
-```
-
-For the others, `aegis install codex|copilot|vscode|cursor`. It only acts in projects with a
-`.aegis/` policy, and only blocks what that policy blocks. See [Coding agents](docs/agents.md).
+![Aegis CLI demo](docs/demo.gif)
 
 ### From a clone
 
@@ -213,11 +216,31 @@ OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rule
 derives **unstructured human constraints** (from Slack, Jira, Git) and applies
 **authority-driven validation** to the agent's intent *before* it reaches the infrastructure.
 
+## How it compares
+
+Other tools stop destructive commands in coding agents, and cover more agents and more kinds of
+command than Aegis does today. The difference is where the rules come from: Aegis treats every
+rule as a claim that has to be checked (was it changed since it was signed, does its cited
+source back it, was its author allowed to write that kind of rule), because in an agent's
+context a rule can arrive from a ticket or a chat message as easily as from you.
+
+| | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
+|---|---|---|---|---|
+| Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
+| Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
+| Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |
+| CI / non-agent use | `aegis check ... --exit-style ci`, Python library | `nah test` | Node.js library mode | `dcg scan` (SARIF) |
+
+"—" means the project's README does not describe it. Checked against each project's README on
+2026-09-27; corrections welcome.
+
 ## Project status / roadmap
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
@@ -234,6 +257,7 @@ of anything you care about.
 
 | Page | Covers |
 | :--- | :--- |
+| [`docs/agents.md`](docs/agents.md) | Claude Code, Codex, Copilot, VS Code and Cursor: install, what gets blocked |
 | [`docs/cli.md`](docs/cli.md) | Exit codes, store health, the Claude Code hook, argv forms, compound commands, dry runs, library usage |
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/README.md

@@ -1,16 +1,31 @@
-# Aegis-DevOps — Policy Verifier for AI DevOps Agents
+# Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
 [![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
 
-**Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
-before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
+**Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
+ticket told them to.**
 
-**Keywords:** AI agent security · AgentOps · prompt injection · context poisoning · policy
-enforcement · policy-as-code · Kubernetes · Terraform · OPA · SRE · LLM guardrails ·
-provenance · infrastructure-as-code
+Aegis-DevOps checks every command an agent wants to run before it runs, and blocks it if your
+policy says no. A policy rule only counts if nobody has edited it since it was signed, and if
+its author was allowed to write that kind of rule. So a planted line in a Jira ticket can't
+become policy.
 
-![Aegis demo](docs/demo.gif)
+![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
+
+### Install in Claude Code
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. It also works as a CI step
+(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
+[Quick start](#quick-start).
 
 ## What it does
 
@@ -60,19 +75,7 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
-### In your coding agent
-
-Aegis can check every shell command Claude Code, Codex, GitHub Copilot (CLI and VS Code) or
-Cursor wants to run, before it runs. In Claude Code:
-
-```bash
-pip install aegis-devops && aegis init .aegis
-claude plugin marketplace add moneytool/aegis-devops
-claude plugin install aegis-devops@aegis-devops
-```
-
-For the others, `aegis install codex|copilot|vscode|cursor`. It only acts in projects with a
-`.aegis/` policy, and only blocks what that policy blocks. See [Coding agents](docs/agents.md).
+![Aegis CLI demo](docs/demo.gif)
 
 ### From a clone
 
@@ -181,11 +184,31 @@ OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rule
 derives **unstructured human constraints** (from Slack, Jira, Git) and applies
 **authority-driven validation** to the agent's intent *before* it reaches the infrastructure.
 
+## How it compares
+
+Other tools stop destructive commands in coding agents, and cover more agents and more kinds of
+command than Aegis does today. The difference is where the rules come from: Aegis treats every
+rule as a claim that has to be checked (was it changed since it was signed, does its cited
+source back it, was its author allowed to write that kind of rule), because in an agent's
+context a rule can arrive from a ticket or a chat message as easily as from you.
+
+| | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
+|---|---|---|---|---|
+| Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
+| Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
+| Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |
+| CI / non-agent use | `aegis check ... --exit-style ci`, Python library | `nah test` | Node.js library mode | `dcg scan` (SARIF) |
+
+"—" means the project's README does not describe it. Checked against each project's README on
+2026-09-27; corrections welcome.
+
 ## Project status / roadmap
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
@@ -202,6 +225,7 @@ of anything you care about.
 
 | Page | Covers |
 | :--- | :--- |
+| [`docs/agents.md`](docs/agents.md) | Claude Code, Codex, Copilot, VS Code and Cursor: install, what gets blocked |
 | [`docs/cli.md`](docs/cli.md) | Exit codes, store health, the Claude Code hook, argv forms, compound commands, dry runs, library usage |
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.3"
+__version__ = "0.1.4"

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/src/aegis_core/hook.py

@@ -255,6 +255,21 @@ def decide(command: str, config_dir: Path, extra_args: list[str] | None = None)
 # --- replying --------------------------------------------------------------------
 
 
+def _both_shapes(decision: str, reason: str) -> dict:
+    """Copilot CLI reads a top-level ``permissionDecision``; VS Code reads
+    ``hookSpecificOutput``. Both read the same ``.github/hooks`` files and
+    the same Copilot plugins, so their reply carries both."""
+    return {
+        "permissionDecision": decision,
+        "permissionDecisionReason": reason,
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": decision,
+            "permissionDecisionReason": reason,
+        },
+    }
+
+
 def render(agent: str, verdict: HookVerdict, *, escalate_as: str = "ask") -> tuple[int, str, str]:
     """``(exit_code, stdout, stderr)`` for this agent. Deny is exit 2 +
     stderr (Cursor: its JSON on exit 0); ask is each agent's own JSON with
@@ -273,11 +288,8 @@ def render(agent: str, verdict: HookVerdict, *, escalate_as: str = "ask") -> tup
             "codex": {"hookSpecificOutput": {
                 "hookEventName": "PreToolUse", "permissionDecision": "deny",
                 "permissionDecisionReason": reason}},
-            "copilot": {"permissionDecision": "deny", "permissionDecisionReason": reason},
-            "vscode": {"permissionDecision": "deny", "permissionDecisionReason": reason,
-                       "hookSpecificOutput": {"hookEventName": "PreToolUse",
-                                              "permissionDecision": "deny",
-                                              "permissionDecisionReason": reason}},
+            "copilot": _both_shapes("deny", reason),
+            "vscode": _both_shapes("deny", reason),
             "cursor": {"permission": "deny", "user_message": reason, "agent_message": reason},
         }[agent]
         if agent == "cursor":
@@ -291,11 +303,8 @@ def render(agent: str, verdict: HookVerdict, *, escalate_as: str = "ask") -> tup
         "claude": {"hookSpecificOutput": {
             "hookEventName": "PreToolUse", "permissionDecision": "ask",
             "permissionDecisionReason": reason}},
-        "copilot": {"permissionDecision": "ask", "permissionDecisionReason": reason},
-        "vscode": {"permissionDecision": "ask", "permissionDecisionReason": reason,
-                   "hookSpecificOutput": {"hookEventName": "PreToolUse",
-                                          "permissionDecision": "ask",
-                                          "permissionDecisionReason": reason}},
+        "copilot": _both_shapes("ask", reason),
+        "vscode": _both_shapes("ask", reason),
         "cursor": {"permission": "ask", "user_message": reason, "agent_message": reason},
     }[agent]
     return EXIT_ALLOW, json.dumps(body), ""

{aegis_devops-0.1.3 → aegis_devops-0.1.4/src/aegis_devops.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.3
+Version: 0.1.4
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -30,19 +30,34 @@ Provides-Extra: llm
 Requires-Dist: anthropic; extra == "llm"
 Dynamic: license-file
 
-# Aegis-DevOps — Policy Verifier for AI DevOps Agents
+# Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
 [![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
 
-**Provenance-backed, authority-aware guardrails that stop context poisoning and agentic drift
-before an AI agent's `kubectl` or `terraform` action reaches your infrastructure.**
+**Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
+ticket told them to.**
 
-**Keywords:** AI agent security · AgentOps · prompt injection · context poisoning · policy
-enforcement · policy-as-code · Kubernetes · Terraform · OPA · SRE · LLM guardrails ·
-provenance · infrastructure-as-code
+Aegis-DevOps checks every command an agent wants to run before it runs, and blocks it if your
+policy says no. A policy rule only counts if nobody has edited it since it was signed, and if
+its author was allowed to write that kind of rule. So a planted line in a Jira ticket can't
+become policy.
 
-![Aegis demo](docs/demo.gif)
+![Aegis-DevOps blocking an injected kubectl delete](docs/where-it-sits.gif)
+
+### Install in Claude Code
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+(see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
+only blocks what that policy blocks. It also works as a CI step
+(`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
+[Quick start](#quick-start).
 
 ## What it does
 
@@ -92,19 +107,7 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
-### In your coding agent
-
-Aegis can check every shell command Claude Code, Codex, GitHub Copilot (CLI and VS Code) or
-Cursor wants to run, before it runs. In Claude Code:
-
-```bash
-pip install aegis-devops && aegis init .aegis
-claude plugin marketplace add moneytool/aegis-devops
-claude plugin install aegis-devops@aegis-devops
-```
-
-For the others, `aegis install codex|copilot|vscode|cursor`. It only acts in projects with a
-`.aegis/` policy, and only blocks what that policy blocks. See [Coding agents](docs/agents.md).
+![Aegis CLI demo](docs/demo.gif)
 
 ### From a clone
 
@@ -213,11 +216,31 @@ OPA/Gatekeeper evaluates **structured API objects** against **hand-authored rule
 derives **unstructured human constraints** (from Slack, Jira, Git) and applies
 **authority-driven validation** to the agent's intent *before* it reaches the infrastructure.
 
+## How it compares
+
+Other tools stop destructive commands in coding agents, and cover more agents and more kinds of
+command than Aegis does today. The difference is where the rules come from: Aegis treats every
+rule as a claim that has to be checked (was it changed since it was signed, does its cited
+source back it, was its author allowed to write that kind of rule), because in an agent's
+context a rule can arrive from a ticket or a chat message as easily as from you.
+
+| | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
+|---|---|---|---|---|
+| Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
+| Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
+| Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |
+| CI / non-agent use | `aegis check ... --exit-style ci`, Python library | `nah test` | Node.js library mode | `dcg scan` (SARIF) |
+
+"—" means the project's README does not describe it. Checked against each project's README on
+2026-09-27; corrections welcome.
+
 ## Project status / roadmap
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
@@ -234,6 +257,7 @@ of anything you care about.
 
 | Page | Covers |
 | :--- | :--- |
+| [`docs/agents.md`](docs/agents.md) | Claude Code, Codex, Copilot, VS Code and Cursor: install, what gets blocked |
 | [`docs/cli.md`](docs/cli.md) | Exit codes, store health, the Claude Code hook, argv forms, compound commands, dry runs, library usage |
 | [`docs/constraints.md`](docs/constraints.md) | Writing constraints, metadata vocabulary, authority policy, environment mapping |
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/src/aegis_devops.egg-info/SOURCES.txt

@@ -97,6 +97,7 @@ tests/test_parser.py
 tests/test_parsers_pulumi.py
 tests/test_parsers_sql.py
 tests/test_plan.py
+tests/test_plugins.py
 tests/test_provenance.py
 tests/test_shell.py
 tests/test_signing.py

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/tests/test_default_rules.py

@@ -108,3 +108,19 @@ def test_plan_json_intents_are_not_caught_by_the_workspace_rule(capsys):
                                   "name": "b", "change": {"actions": ["delete"]}}]}
     [intent] = from_terraform_plan(plan)
     assert not intent.resource.startswith("workspace/")
+
+
+def test_forged_sources_differ_from_sources_in_one_file_only():
+    """data/sources-forged/ is data/sources/ with jira-1001.json edited, for
+    the --sources demo. Any other difference (a source missing after new
+    rules were added) quarantines more rules and breaks the demo."""
+    from pathlib import Path
+
+    real, forged = Path("data/sources"), Path("data/sources-forged")
+    names = {p.name for p in real.iterdir()} | {p.name for p in forged.iterdir()}
+    differing = sorted(
+        n for n in names - {"AEGIS-MANIFEST.sig"}
+        if not (real / n).exists() or not (forged / n).exists()
+        or (real / n).read_bytes() != (forged / n).read_bytes()
+    )
+    assert differing == ["jira-1001.json"]

{aegis_devops-0.1.3 → aegis_devops-0.1.4}/tests/test_hook.py

@@ -625,3 +625,12 @@ def test_remove_deletes_a_file_that_only_held_our_hook(tmp_path, monkeypatch):
 def test_cursor_allow_is_explicit_when_opted_in(opted_in_project):
     code, out, _err = run("cursor", payload_for("cursor", "ls -la"))
     assert (code, json.loads(out)) == (0, {"permission": "allow"})
+
+
+def test_copilot_reply_carries_the_vscode_shape_too(opted_in_project):
+    # Copilot plugins and .github/hooks are read by both Copilot CLI and VS Code
+    code, out, _err = run("copilot", payload_for("copilot", BLOCK_COMMAND))
+    body = json.loads(out)
+    assert code == 2
+    assert body["permissionDecision"] == "deny"
+    assert body["hookSpecificOutput"]["permissionDecision"] == "deny"

aegis_devops-0.1.4/tests/test_plugins.py

@@ -0,0 +1,76 @@
+"""Packaging of the Claude Code and Copilot plugins, and the wrapper script
+they both run when ``aegis`` itself may be missing."""
+
+import json
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from aegis_core import __version__
+
+ROOT = Path(__file__).resolve().parent.parent
+WRAPPER = ROOT / "hooks" / "aegis-hook.sh"
+COPILOT = ROOT / "plugins" / "copilot"
+
+
+def test_copilot_plugin_manifest():
+    manifest = json.loads((COPILOT / "plugin.json").read_text())
+    assert manifest["$schema"] == "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
+    assert manifest["name"] == "aegis-devops"
+    # awesome-copilot pins a semver version to a release tag
+    assert manifest["version"] == __version__
+
+
+def test_copilot_plugin_hook_runs_the_wrapper():
+    hooks = json.loads((COPILOT / "com.github.copilot" / "hooks" / "hooks.json").read_text())
+    [entry] = hooks["hooks"]["preToolUse"]
+    assert entry["bash"] == '"${PLUGIN_ROOT}"/aegis-hook.sh copilot'
+    assert (COPILOT / "aegis-hook.sh").stat().st_mode & 0o111
+
+
+def test_copilot_wrapper_is_a_copy_of_the_claude_one():
+    # a plugin can only ship files inside its own folder
+    assert (COPILOT / "aegis-hook.sh").read_bytes() == WRAPPER.read_bytes()
+
+
+def test_claude_plugin_hook_runs_the_wrapper():
+    hooks = json.loads((ROOT / "hooks" / "hooks.json").read_text())
+    [entry] = hooks["hooks"]["PreToolUse"]
+    assert entry["matcher"] == "Bash"
+    assert entry["hooks"][0]["command"] == '"${CLAUDE_PLUGIN_ROOT}"/hooks/aegis-hook.sh claude'
+
+
+# --- the wrapper with no aegis installed --------------------------------------------
+
+
+def _run_wrapper(tmp_path, command, *, opted_in):
+    home, project = tmp_path / "home", tmp_path / "project"
+    home.mkdir()
+    project.mkdir()
+    if opted_in:
+        (project / ".aegis").mkdir()
+    env = {"HOME": str(home), "PATH": "/usr/bin:/bin"}  # no aegis, no uvx
+    payload = json.dumps({"toolName": "bash", "toolArgs": {"command": command}})
+    proc = subprocess.run(
+        ["bash", str(WRAPPER), "copilot"], input=payload, capture_output=True, text=True,
+        cwd=project, env=env, check=False,
+    )
+    return proc.returncode, proc.stderr
+
+
+@pytest.mark.skipif(os.name == "nt", reason="bash wrapper")
+@pytest.mark.parametrize("command", ["ls -la", "kubectl delete nodes --all"])
+def test_wrapper_without_aegis_allows_everything_outside_opted_in_projects(tmp_path, command):
+    assert _run_wrapper(tmp_path, command, opted_in=False) == (0, "")
+
+
+@pytest.mark.skipif(os.name == "nt", reason="bash wrapper")
+def test_wrapper_without_aegis_blocks_only_infra_in_opted_in_projects(tmp_path):
+    code, err = _run_wrapper(tmp_path, "kubectl get pods", opted_in=True)
+    assert code == 2
+    assert "pip install aegis-devops" in err
+    (tmp_path / "home").rename(tmp_path / "old-home")
+    (tmp_path / "project").rename(tmp_path / "old-project")
+    assert _run_wrapper(tmp_path, "ls -la", opted_in=True) == (0, "")