aegis-devops 0.1.4__tar.gz → 0.1.6__tar.gz

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/MANIFEST.in

@@ -1,3 +1,4 @@
 include README.md
 include LICENSE
 recursive-include src/aegis_core/_examples *
+recursive-include src/aegis_core/integrations *

{aegis_devops-0.1.4/src/aegis_devops.egg-info → aegis_devops-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.4
+Version: 0.1.6
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -53,7 +53,15 @@ claude plugin marketplace add moneytool/aegis-devops
 claude plugin install aegis-devops@aegis-devops
 ```
 
-Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+### Install in Gemini CLI
+
+```bash
+pip install aegis-devops && aegis init .aegis
+gemini extensions install https://github.com/moneytool/aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
+`aegis install codex|copilot|vscode|cursor|opencode`
 (see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
 only blocks what that policy blocks. It also works as a CI step
 (`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
@@ -178,20 +186,21 @@ oracle that never imports Aegis's own code. The full table
 (precision/recall/F1, latency, coverage) and methodology are in
 [`docs/benchmark.md`](docs/benchmark.md); the columns that matter most are summarized below.
 
-| verifier | over-block | poison-susceptibility | ps_unauth + pe_unauth |
-| :--- | ---: | ---: | ---: |
-| **aegis** | **0.000** | **0.000** | **0.000** |
-| codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
-| claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
-| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
-| claude-cli-opus | 0.150 | 0.300 | 0.200 |
-| claude-cli-fable | 0.150 | 0.300 | 0.200 |
-| opa-signed | 0.250 | 0.500 | 1.000 |
-| opa | 0.500 | 1.000 | 1.000 |
-| llm-heuristic | 0.500 | 1.000 | 1.000 |
-| ollama (mistral 7B) | 1.000 | 1.000 | 1.000 |
+| verifier | rules shown & scored on | over-block | poison-susceptibility | ps_unauth + pe_unauth |
+| :--- | ---: | ---: | ---: | ---: |
+| **aegis** | 500 | **0.000** | **0.000** | **0.000** |
+| opa-signed | 500 | 0.250 | 0.500 | 1.000 |
+| opa | 500 | 0.500 | 1.000 | 1.000 |
+| llm-heuristic | 500 | 0.500 | 1.000 | 1.000 |
+| **aegis-holdout** | 100 | **0.000** | **0.000** | **0.000** |
+| codex (gpt-6-astra) | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-sol | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-luna | 100 | 0.188 | 0.789 | 0.500 |
+| claude-cli (haiku) | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-sonnet | 100 | 0.259 | 1.000 | 1.000 |
+| claude-cli-opus | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-fable | 100 | 0.235 | 1.000 | 1.000 |
+| ollama (mistral 7B) | 100 | 1.000 | 1.000 | 1.000 |
 
 `poison-susceptibility` (`ps + pe`) is the fraction of poisoned rules — constraints an
 unauthorized/tampered/forged author slipped in — that moved a verdict at all, split by kind;
@@ -203,12 +212,15 @@ exactly that reason, while Aegis's independent authority check scores `0.000`.
 The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
 completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
 5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
-model that actually answered — and — unlike the other rows — are scored against a
-100-constraint holdout subset rather than the full 500-constraint store, for context-window and
-cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
-else in the table. Model size and vendor do not change the picture: all seven land between
-0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
-reason about who wrote a rule, but not recompute a hash or fetch a source.
+model that actually answered. For context-window and cost reasons they, and the local model,
+are shown only the corpus's 100-constraint holdout subset, so they are **scored against the
+oracle over those same 100 rules** (19 poison candidates rather than 30); `aegis-holdout` runs
+Aegis on the same 100 for a like-for-like row. Compare rows within one "rules" value. On that
+basis model size and vendor do not change the picture: six of the seven models act on every
+poisoned rule they are shown, `gpt-6-luna` on 15 of 19, and Aegis on none. A model can reason
+about who wrote a rule, but it cannot recompute a hash or fetch a source. Up to v0.1.5 these
+rows were scored against all 500 rules, which counted rules the models never saw as resisted
+poison and understated their susceptibility (0.23–0.33); see [`CHANGELOG.md`](CHANGELOG.md).
 
 ## Why not OPA/Gatekeeper?
 
@@ -227,7 +239,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 | | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
 |---|---|---|---|---|
 | Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
-| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor, Gemini CLI, OpenCode | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
 | Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
 | Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
 | Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/README.md

@@ -21,7 +21,15 @@ claude plugin marketplace add moneytool/aegis-devops
 claude plugin install aegis-devops@aegis-devops
 ```
 
-Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+### Install in Gemini CLI
+
+```bash
+pip install aegis-devops && aegis init .aegis
+gemini extensions install https://github.com/moneytool/aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
+`aegis install codex|copilot|vscode|cursor|opencode`
 (see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
 only blocks what that policy blocks. It also works as a CI step
 (`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
@@ -146,20 +154,21 @@ oracle that never imports Aegis's own code. The full table
 (precision/recall/F1, latency, coverage) and methodology are in
 [`docs/benchmark.md`](docs/benchmark.md); the columns that matter most are summarized below.
 
-| verifier | over-block | poison-susceptibility | ps_unauth + pe_unauth |
-| :--- | ---: | ---: | ---: |
-| **aegis** | **0.000** | **0.000** | **0.000** |
-| codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
-| claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
-| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
-| claude-cli-opus | 0.150 | 0.300 | 0.200 |
-| claude-cli-fable | 0.150 | 0.300 | 0.200 |
-| opa-signed | 0.250 | 0.500 | 1.000 |
-| opa | 0.500 | 1.000 | 1.000 |
-| llm-heuristic | 0.500 | 1.000 | 1.000 |
-| ollama (mistral 7B) | 1.000 | 1.000 | 1.000 |
+| verifier | rules shown & scored on | over-block | poison-susceptibility | ps_unauth + pe_unauth |
+| :--- | ---: | ---: | ---: | ---: |
+| **aegis** | 500 | **0.000** | **0.000** | **0.000** |
+| opa-signed | 500 | 0.250 | 0.500 | 1.000 |
+| opa | 500 | 0.500 | 1.000 | 1.000 |
+| llm-heuristic | 500 | 0.500 | 1.000 | 1.000 |
+| **aegis-holdout** | 100 | **0.000** | **0.000** | **0.000** |
+| codex (gpt-6-astra) | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-sol | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-luna | 100 | 0.188 | 0.789 | 0.500 |
+| claude-cli (haiku) | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-sonnet | 100 | 0.259 | 1.000 | 1.000 |
+| claude-cli-opus | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-fable | 100 | 0.235 | 1.000 | 1.000 |
+| ollama (mistral 7B) | 100 | 1.000 | 1.000 | 1.000 |
 
 `poison-susceptibility` (`ps + pe`) is the fraction of poisoned rules — constraints an
 unauthorized/tampered/forged author slipped in — that moved a verdict at all, split by kind;
@@ -171,12 +180,15 @@ exactly that reason, while Aegis's independent authority check scores `0.000`.
 The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
 completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
 5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
-model that actually answered — and — unlike the other rows — are scored against a
-100-constraint holdout subset rather than the full 500-constraint store, for context-window and
-cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
-else in the table. Model size and vendor do not change the picture: all seven land between
-0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
-reason about who wrote a rule, but not recompute a hash or fetch a source.
+model that actually answered. For context-window and cost reasons they, and the local model,
+are shown only the corpus's 100-constraint holdout subset, so they are **scored against the
+oracle over those same 100 rules** (19 poison candidates rather than 30); `aegis-holdout` runs
+Aegis on the same 100 for a like-for-like row. Compare rows within one "rules" value. On that
+basis model size and vendor do not change the picture: six of the seven models act on every
+poisoned rule they are shown, `gpt-6-luna` on 15 of 19, and Aegis on none. A model can reason
+about who wrote a rule, but it cannot recompute a hash or fetch a source. Up to v0.1.5 these
+rows were scored against all 500 rules, which counted rules the models never saw as resisted
+poison and understated their susceptibility (0.23–0.33); see [`CHANGELOG.md`](CHANGELOG.md).
 
 ## Why not OPA/Gatekeeper?
 
@@ -195,7 +207,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 | | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
 |---|---|---|---|---|
 | Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
-| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor, Gemini CLI, OpenCode | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
 | Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
 | Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
 | Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/pyproject.toml

@@ -62,7 +62,7 @@ version = {attr = "aegis_core.__version__"}
 where = ["src"]
 
 [tool.setuptools.package-data]
-aegis_core = ["_examples/**/*"]
+aegis_core = ["_examples/**/*", "integrations/*"]
 
 [tool.ruff]
 line-length = 100

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.4"
+__version__ = "0.1.6"

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/src/aegis_core/hook.py

@@ -41,6 +41,7 @@ is a deny.
 from __future__ import annotations
 
 import contextlib
+import importlib.resources
 import io
 import json
 import os
@@ -53,7 +54,7 @@ from pathlib import Path
 from aegis_core import config as config_module
 from aegis_core.shell import _KNOWN_BINARIES, ShellRejected, intents_from_command
 
-AGENTS = ("claude", "codex", "copilot", "cursor", "vscode")
+AGENTS = ("claude", "codex", "copilot", "cursor", "gemini", "opencode", "vscode")
 
 # Binaries whose commands are gated even when the policy is unusable or the
 # command cannot be parsed. terraform/tofu have no argv parser (their plans
@@ -156,6 +157,7 @@ def _project_dir(request: HookRequest) -> Path:
         os.environ.get("CLAUDE_PROJECT_DIR"),
         os.environ.get("COPILOT_PROJECT_DIR"),
         os.environ.get("CURSOR_PROJECT_DIR"),
+        os.environ.get("GEMINI_PROJECT_DIR"),
     ):
         if candidate:
             return Path(candidate)
@@ -255,6 +257,11 @@ def decide(command: str, config_dir: Path, extra_args: list[str] | None = None)
 # --- replying --------------------------------------------------------------------
 
 
+# Agents whose hooks cannot ask the user: an ESCALATE is a deny there.
+# (Codex treats an unknown decision as an error and runs the command.)
+_NO_ASK = frozenset({"codex", "gemini", "opencode"})
+
+
 def _both_shapes(decision: str, reason: str) -> dict:
     """Copilot CLI reads a top-level ``permissionDecision``; VS Code reads
     ``hookSpecificOutput``. Both read the same ``.github/hooks`` files and
@@ -275,7 +282,7 @@ def render(agent: str, verdict: HookVerdict, *, escalate_as: str = "ask") -> tup
     stderr (Cursor: its JSON on exit 0); ask is each agent's own JSON with
     exit 0."""
     decision = verdict.decision
-    if decision == "ask" and (agent == "codex" or escalate_as == "deny"):
+    if decision == "ask" and (agent in _NO_ASK or escalate_as == "deny"):
         decision = "deny"
     if decision == "allow":
         return _allow(agent)
@@ -291,6 +298,9 @@ def render(agent: str, verdict: HookVerdict, *, escalate_as: str = "ask") -> tup
             "copilot": _both_shapes("deny", reason),
             "vscode": _both_shapes("deny", reason),
             "cursor": {"permission": "deny", "user_message": reason, "agent_message": reason},
+            "gemini": {"decision": "deny", "reason": reason},
+            # the OpenCode plugin throws with stderr; stdout is not read
+            "opencode": {"decision": "deny", "reason": reason},
         }[agent]
         if agent == "cursor":
             # Cursor shows the stdout of an exit-2 hook verbatim as the
@@ -389,6 +399,10 @@ def config_path(agent: str, *, user: bool, project: Path) -> Path:
         ("vscode", False): project / ".github" / "hooks" / "aegis-vscode.json",
         ("cursor", True): home / ".cursor" / "hooks.json",
         ("cursor", False): project / ".cursor" / "hooks.json",
+        ("gemini", True): home / ".gemini" / "settings.json",
+        ("gemini", False): project / ".gemini" / "settings.json",
+        ("opencode", True): home / ".config" / "opencode" / "plugins" / "aegis-devops.js",
+        ("opencode", False): project / ".opencode" / "plugins" / "aegis-devops.js",
     }[(agent, user)]
 
 
@@ -423,6 +437,12 @@ def merge_config(agent: str, existing: dict, command: str | None) -> dict:
             "matcher": "Bash" if agent == "claude" else "^Bash$",
             "hooks": [{"type": "command", "command": command, "timeout": 30}],
         }
+    elif agent == "gemini":
+        event, entry = "BeforeTool", {
+            "matcher": "run_shell_command",
+            "hooks": [{"name": "aegis-devops", "type": "command", "command": command,
+                       "timeout": 30000}],
+        }
     elif agent == "copilot":
         doc.setdefault("version", 1)
         event, entry = "preToolUse", {"type": "command", "bash": command, "timeoutSec": 30}
@@ -454,11 +474,33 @@ _AFTER_INSTALL = {
     "vscode": "Hooks are a Preview feature in VS Code; enable chat hooks in its settings if "
     "they do not run.",
     "cursor": "Restart Cursor to load it.",
+    "gemini": "Restart Gemini CLI; '/hooks' lists it (project hooks may ask to be trusted).",
+    "opencode": "Restart OpenCode to load the plugin.",
 }
 
 
+def _install_opencode_plugin(path: Path, *, remove: bool) -> Path:
+    """OpenCode hooks are JS plugins: write (or delete) our plugin file, with
+    the argv of this aegis filled in."""
+    if remove:
+        if path.exists():
+            path.unlink()
+        return path
+    template = (
+        importlib.resources.files("aegis_core") / "integrations" / "opencode-plugin.js"
+    ).read_text()
+    marker = "const INSTALLED = null"
+    if marker not in template:
+        raise ValueError("opencode plugin template has no INSTALLED marker")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(template.replace(marker, f"const INSTALLED = {json.dumps(_aegis_command())}"))
+    return path
+
+
 def install(agent: str, *, user: bool, project: Path, remove: bool = False) -> Path:
     path = config_path(agent, user=user, project=project)
+    if agent == "opencode":
+        return _install_opencode_plugin(path, remove=remove)
     existing: dict = {}
     if path.exists():
         text = path.read_text()

aegis_devops-0.1.6/src/aegis_core/integrations/opencode-plugin.js

@@ -0,0 +1,62 @@
+// Aegis-DevOps plugin for OpenCode: checks each bash command against the
+// project's Aegis policy before it runs. Written by `aegis install opencode`
+// into .opencode/plugins/ (or ~/.config/opencode/plugins/ with --user).
+//
+// OpenCode hooks are plugins, not shell commands, so this hands the command to
+// `aegis hook opencode` and throws (which blocks the call and shows the model
+// the reason) when Aegis says no. Everything is decided by aegis itself: it
+// allows every command outside projects with a policy (.aegis/ here or above,
+// $AEGIS_CONFIG_DIR, ~/.config/aegis), and inside one blocks only what the
+// policy blocks. If aegis cannot be started, the same rule applies in its
+// crudest form: in an opted-in project block commands naming an
+// infrastructure binary, allow the rest.
+import { spawnSync } from "node:child_process"
+import { existsSync } from "node:fs"
+import { homedir } from "node:os"
+import { dirname, join, resolve } from "node:path"
+
+// `aegis install opencode` replaces null with the argv that starts the aegis
+// it was run from (GUI apps do not see your shell's PATH).
+const INSTALLED = null
+const AEGIS = process.env.AEGIS_BIN ? [process.env.AEGIS_BIN] : INSTALLED || ["aegis"]
+const INFRA =
+  /(^|[^\w.-])(kubectl|k|terraform|tf|tofu|aws|az|gcloud|gsutil|helm|argocd|flux|git|gh|psql|mysql|sqlite3|mongosh|pulumi|alembic|flyway|rails|prisma)([^\w.-]|$)/
+
+function optedIn(start) {
+  if (process.env.AEGIS_CONFIG_DIR) return true
+  if (existsSync(join(homedir(), ".config", "aegis"))) return true
+  let dir = resolve(start || process.cwd())
+  for (;;) {
+    if (existsSync(join(dir, ".aegis"))) return true
+    const parent = dirname(dir)
+    if (parent === dir) return false
+    dir = parent
+  }
+}
+
+export const AegisDevOps = async ({ directory }) => ({
+  "tool.execute.before": async (input, output) => {
+    if (input?.tool !== "bash") return
+    const command = output?.args?.command
+    if (typeof command !== "string" || !command.trim()) return
+    const cwd = directory || process.cwd()
+    const payload = JSON.stringify({ tool_name: "bash", tool_input: { command }, cwd })
+    const run = spawnSync(AEGIS[0], [...AEGIS.slice(1), "hook", "opencode"], {
+      input: payload,
+      encoding: "utf8",
+      timeout: 30000,
+      cwd,
+    })
+    if (run.error || run.status === null) {
+      if (optedIn(cwd) && INFRA.test(command)) {
+        throw new Error(
+          "aegis-devops could not run, so this infrastructure command cannot be checked: " +
+            "run 'pip install aegis-devops' (blocking to fail closed)",
+        )
+      }
+      return
+    }
+    if (run.status === 0) return
+    throw new Error((run.stderr || "").trim() || `aegis: blocked (exit ${run.status})`)
+  },
+})

{aegis_devops-0.1.4 → aegis_devops-0.1.6/src/aegis_devops.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.4
+Version: 0.1.6
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -53,7 +53,15 @@ claude plugin marketplace add moneytool/aegis-devops
 claude plugin install aegis-devops@aegis-devops
 ```
 
-Codex, GitHub Copilot (CLI and VS Code) and Cursor: `aegis install codex|copilot|vscode|cursor`
+### Install in Gemini CLI
+
+```bash
+pip install aegis-devops && aegis init .aegis
+gemini extensions install https://github.com/moneytool/aegis-devops
+```
+
+Codex, GitHub Copilot (CLI and VS Code), Cursor and OpenCode:
+`aegis install codex|copilot|vscode|cursor|opencode`
 (see [Coding agents](docs/agents.md)). It only acts in projects with a `.aegis/` policy, and
 only blocks what that policy blocks. It also works as a CI step
 (`aegis check terraform plan.json --exit-style ci`) and as a Python library; see
@@ -178,20 +186,21 @@ oracle that never imports Aegis's own code. The full table
 (precision/recall/F1, latency, coverage) and methodology are in
 [`docs/benchmark.md`](docs/benchmark.md); the columns that matter most are summarized below.
 
-| verifier | over-block | poison-susceptibility | ps_unauth + pe_unauth |
-| :--- | ---: | ---: | ---: |
-| **aegis** | **0.000** | **0.000** | **0.000** |
-| codex (gpt-6-astra) | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-sol | 0.150 | 0.300 | 0.200 |
-| codex-gpt-6-luna | 0.117 | 0.233 | 0.100 |
-| claude-cli (haiku) | 0.150 | 0.300 | 0.200 |
-| claude-cli-sonnet | 0.167 | 0.333 | 0.200 |
-| claude-cli-opus | 0.150 | 0.300 | 0.200 |
-| claude-cli-fable | 0.150 | 0.300 | 0.200 |
-| opa-signed | 0.250 | 0.500 | 1.000 |
-| opa | 0.500 | 1.000 | 1.000 |
-| llm-heuristic | 0.500 | 1.000 | 1.000 |
-| ollama (mistral 7B) | 1.000 | 1.000 | 1.000 |
+| verifier | rules shown & scored on | over-block | poison-susceptibility | ps_unauth + pe_unauth |
+| :--- | ---: | ---: | ---: | ---: |
+| **aegis** | 500 | **0.000** | **0.000** | **0.000** |
+| opa-signed | 500 | 0.250 | 0.500 | 1.000 |
+| opa | 500 | 0.500 | 1.000 | 1.000 |
+| llm-heuristic | 500 | 0.500 | 1.000 | 1.000 |
+| **aegis-holdout** | 100 | **0.000** | **0.000** | **0.000** |
+| codex (gpt-6-astra) | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-sol | 100 | 0.224 | 1.000 | 1.000 |
+| codex-gpt-6-luna | 100 | 0.188 | 0.789 | 0.500 |
+| claude-cli (haiku) | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-sonnet | 100 | 0.259 | 1.000 | 1.000 |
+| claude-cli-opus | 100 | 0.235 | 1.000 | 1.000 |
+| claude-cli-fable | 100 | 0.235 | 1.000 | 1.000 |
+| ollama (mistral 7B) | 100 | 1.000 | 1.000 | 1.000 |
 
 `poison-susceptibility` (`ps + pe`) is the fraction of poisoned rules — constraints an
 unauthorized/tampered/forged author slipped in — that moved a verdict at all, split by kind;
@@ -203,12 +212,15 @@ exactly that reason, while Aegis's independent authority check scores `0.000`.
 The `codex*` and `claude-cli*` rows are **agent harnesses wrapped around a model**, not raw
 completions — seven models across two vendors (Claude Haiku 4.5, Sonnet 5, Opus 5 and Fable
 5.1; GPT `gpt-6-astra`, `gpt-6-sol` and `gpt-6-luna`), each verified before its run to be the
-model that actually answered — and — unlike the other rows — are scored against a
-100-constraint holdout subset rather than the full 500-constraint store, for context-window and
-cost reasons; see [`docs/benchmark.md`](docs/benchmark.md) before comparing them with anything
-else in the table. Model size and vendor do not change the picture: all seven land between
-0.23 and 0.33 poison-susceptibility, and every one acts on 5 of 8 forged rules — a model can
-reason about who wrote a rule, but not recompute a hash or fetch a source.
+model that actually answered. For context-window and cost reasons they, and the local model,
+are shown only the corpus's 100-constraint holdout subset, so they are **scored against the
+oracle over those same 100 rules** (19 poison candidates rather than 30); `aegis-holdout` runs
+Aegis on the same 100 for a like-for-like row. Compare rows within one "rules" value. On that
+basis model size and vendor do not change the picture: six of the seven models act on every
+poisoned rule they are shown, `gpt-6-luna` on 15 of 19, and Aegis on none. A model can reason
+about who wrote a rule, but it cannot recompute a hash or fetch a source. Up to v0.1.5 these
+rows were scored against all 500 rules, which counted rules the models never saw as resisted
+poison and understated their susceptibility (0.23–0.33); see [`CHANGELOG.md`](CHANGELOG.md).
 
 ## Why not OPA/Gatekeeper?
 
@@ -227,7 +239,7 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 | | Aegis-DevOps | [nah](https://github.com/manuelschipper/nah) | [claude-code-safety-net](https://github.com/kenryu42/claude-code-safety-net) | [destructive_command_guard](https://github.com/Dicklesworthstone/destructive_command_guard) |
 |---|---|---|---|---|
 | Guards | Infra commands and plans: kubectl, terraform/tofu, aws/az/gcloud, helm, argocd, flux, git/gh, SQL, pulumi | Git, filesystem, infra CLIs (Terraform, OpenTofu, Pulumi, kubectl, Docker), secrets, publishing | Destructive git and filesystem commands, secret access; cloud CLIs via optional rulebooks | Git, filesystem, databases, Kubernetes, IaC, clouds, Docker and more (50+ packs) |
-| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
+| Agents | Claude Code, Codex, Copilot CLI, VS Code, Cursor, Gemini CLI, OpenCode | Claude Code, Codex, Cursor, Copilot and 10+ more | Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and 8+ more | Claude Code, Codex, Copilot, Cursor, Gemini CLI and 9+ more |
 | Rules | Signed rules, each citing a source and an author; checked against an authority map (who may assert what) | Built-in deterministic guards; custom guards can only make it stricter | Built-in AST-based protections, configurable presets, community rulebooks | Built-in regex/AST packs, TOML config, custom YAML packs |
 | Rule provenance and authority | Yes: a tampered, forged or unauthorised rule gets no vote | — | — | — |
 | Terraform/Pulumi plan checks | Yes (plan JSON) | Whole-stack destroy commands | Commands via rulebooks | Destroy commands |

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/src/aegis_devops.egg-info/SOURCES.txt

@@ -70,6 +70,7 @@ src/aegis_core/baselines/external.py
 src/aegis_core/baselines/llm.py
 src/aegis_core/baselines/metrics.py
 src/aegis_core/baselines/opa.py
+src/aegis_core/integrations/opencode-plugin.js
 src/aegis_core/parsers/__init__.py
 src/aegis_core/parsers/pulumi.py
 src/aegis_core/parsers/sql.py
@@ -93,6 +94,7 @@ tests/test_hook.py
 tests/test_intent.py
 tests/test_interceptor.py
 tests/test_ledger.py
+tests/test_opencode_plugin.py
 tests/test_parser.py
 tests/test_parsers_pulumi.py
 tests/test_parsers_sql.py

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/tests/test_benchmark.py

@@ -267,3 +267,41 @@ def test_benchmark_split_dev_is_allowed(tmp_path):
         split = json.load(f)
     assert payload["meta"]["split"] == "dev"
     assert payload["meta"]["n_intents"] == len(split["intents"]["dev"])
+
+
+# --- every row is scored against the rules it was shown ---------------------------
+
+
+def test_published_rows_are_scored_on_the_rules_they_were_shown():
+    """A row shown the 100-constraint holdout subset must be scored against
+    the oracle over those 100, not all 500: scoring it on all 500 counts
+    every rule it never saw as a missed legitimate rule or as resisted
+    poison (the pre-v0.1.6 bug)."""
+    results = json.loads((REPO_ROOT / "results" / "benchmark.json").read_text())
+    n_holdout = results["meta"]["n_constraints_holdout"]
+    for name, row in results["verifiers"].items():
+        if row.get("skipped"):
+            continue
+        want = "holdout" if row["n_constraints_fed"] == n_holdout else "full"
+        assert row["scored_against"] == want, name
+        if want == "holdout":
+            m = row["metrics"]
+            total = m["poison_candidate_count"]
+            assert total == results["meta"]["poison_candidates_holdout"], name
+
+
+def test_holdout_oracle_only_sees_the_holdout_constraints(monkeypatch):
+    monkeypatch.syspath_prepend(str(REPO_ROOT / "scripts"))
+    import benchmark
+    import reference_oracle
+
+    corpus = REPO_ROOT / "data" / "corpus"
+    split = json.loads((corpus / "split.json").read_text())
+    hold = set(split["holdout"])
+    intents = [i for i in reference_oracle.read_jsonl(corpus / "intents.jsonl")
+               if i["id"] in set(split["intents"]["holdout"])]
+    truth = benchmark.oracle_ground_truth_over(corpus, intents, hold)
+    for rec in truth:
+        matched = set(rec["matched_trusted"]) | set(rec["matched_untrusted"]) | set(
+            rec["matched_malicious"])
+        assert matched <= hold

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/tests/test_hook.py

@@ -117,8 +117,17 @@ AGENT_PAYLOAD_BUILDERS = {
     "vscode": claude_payload,
     "copilot": copilot_payload,
     "cursor": cursor_payload,
+    # Gemini CLI's BeforeTool payload; its shell tool is run_shell_command
+    "gemini": lambda command, cwd=None: {
+        **claude_payload(command, cwd, tool_name="run_shell_command"),
+        "hook_event_name": "BeforeTool",
+    },
+    # what the bundled OpenCode plugin sends
+    "opencode": lambda command, cwd=None: claude_payload(command, cwd, tool_name="bash"),
 }
 
+JSON_CONFIG_AGENTS = tuple(a for a in hook.AGENTS if a != "opencode")
+
 
 def payload_for(agent: str, command: str | None, cwd: str | None = None) -> dict:
     return AGENT_PAYLOAD_BUILDERS[agent](command, cwd)
@@ -316,6 +325,9 @@ def test_escalate_codex_denies(opted_in_project):
 @pytest.mark.parametrize("agent", hook.AGENTS)
 def test_escalate_as_deny_denies_for_every_agent(opted_in_project, agent):
     code, out, err = run(agent, payload_for(agent, ESCALATE_COMMAND), escalate_as="deny")
+    if agent in ("gemini", "opencode"):
+        assert code == 2 and err
+        return
     if agent == "cursor":
         assert (code, json.loads(out)["permission"]) == (0, "deny")
     else:
@@ -507,7 +519,7 @@ def test_install_cursor_json_shape(isolated, tmp_path):
     assert "hook cursor" in entries[0]["command"]
 
 
-@pytest.mark.parametrize("agent", hook.AGENTS)
+@pytest.mark.parametrize("agent", JSON_CONFIG_AGENTS)
 def test_install_is_idempotent(isolated, agent, tmp_path):
     hook.install(agent, user=False, project=tmp_path)
     path = hook.install(agent, user=False, project=tmp_path)
@@ -540,7 +552,7 @@ def test_install_preserves_unrelated_settings_and_hooks(isolated, tmp_path):
     assert matchers == {"Write", "Bash"}
 
 
-@pytest.mark.parametrize("agent", hook.AGENTS)
+@pytest.mark.parametrize("agent", JSON_CONFIG_AGENTS)
 def test_install_remove_removes_only_ours(isolated, agent, tmp_path):
     path = hook.config_path(agent, user=False, project=tmp_path)
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -634,3 +646,42 @@ def test_copilot_reply_carries_the_vscode_shape_too(opted_in_project):
     assert code == 2
     assert body["permissionDecision"] == "deny"
     assert body["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+# --- Gemini CLI and OpenCode ------------------------------------------------------
+
+
+def test_gemini_deny_format(opted_in_project):
+    code, out, err = run("gemini", payload_for("gemini", BLOCK_COMMAND))
+    assert code == 2
+    assert json.loads(out)["decision"] == "deny"
+    assert "no-delete-nodes" in err
+
+
+@pytest.mark.parametrize("agent", ["gemini", "opencode"])
+def test_escalate_is_a_deny_where_the_agent_cannot_ask(opted_in_project, agent):
+    code, _out, err = run(agent, payload_for(agent, ESCALATE_COMMAND))
+    assert code == 2
+    assert "ESCALATE" in err
+
+
+def test_install_gemini_json_shape(isolated, tmp_path):
+    path = hook.install("gemini", user=False, project=tmp_path)
+    assert path == tmp_path / ".gemini" / "settings.json"
+    [entry] = json.loads(path.read_text())["hooks"]["BeforeTool"]
+    assert entry["matcher"] == "run_shell_command"
+    assert entry["hooks"][0]["command"].endswith("hook gemini")
+    assert entry["hooks"][0]["timeout"] == 30000  # milliseconds in Gemini CLI
+
+
+def test_install_opencode_writes_the_plugin_with_this_aegis(isolated, tmp_path):
+    path = hook.install("opencode", user=False, project=tmp_path)
+    assert path == tmp_path / ".opencode" / "plugins" / "aegis-devops.js"
+    text = path.read_text()
+    assert "const INSTALLED = null" not in text
+    assert f"const INSTALLED = {json.dumps(hook._aegis_command())}" in text
+    assert "tool.execute.before" in text
+    hook.install("opencode", user=False, project=tmp_path)  # idempotent: rewrites
+    assert path.read_text() == text
+    hook.install("opencode", user=False, project=tmp_path, remove=True)
+    assert not path.exists()

aegis_devops-0.1.6/tests/test_opencode_plugin.py

@@ -0,0 +1,87 @@
+"""The bundled OpenCode plugin, run under Node (OpenCode runs plugins in Bun,
+which provides the same node:child_process/fs/os/path APIs it uses)."""
+
+import json
+import shutil
+import subprocess
+
+import pytest
+
+from aegis_core import hook
+from aegis_core.cli import main
+from aegis_core.signing import load_key
+
+NODE = shutil.which("node")
+pytestmark = pytest.mark.skipif(NODE is None, reason="node not installed")
+EXAMPLE_KEY = load_key("file:data/example-signing.key")
+
+HARNESS = """
+import { pathToFileURL } from "node:url"
+const [pluginPath, directory, command] = process.argv.slice(2)
+const { AegisDevOps } = await import(pathToFileURL(pluginPath).href)
+const hooks = await AegisDevOps({ directory })
+try {
+  await hooks["tool.execute.before"]({ tool: "bash" }, { args: { command } })
+  console.log(JSON.stringify({ allowed: true }))
+} catch (e) {
+  console.log(JSON.stringify({ allowed: false, message: e.message }))
+}
+"""
+
+
+@pytest.fixture
+def env(tmp_path, monkeypatch):
+    home, project = tmp_path / "home", tmp_path / "project"
+    home.mkdir()
+    project.mkdir()
+    for var in ("AEGIS_CONFIG_DIR", "CLAUDE_PROJECT_DIR", "COPILOT_PROJECT_DIR",
+                "CURSOR_PROJECT_DIR", "GEMINI_PROJECT_DIR", "AEGIS_BIN"):
+        monkeypatch.delenv(var, raising=False)
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setenv("AEGIS_SIGNING_KEY", EXAMPLE_KEY.hex())
+    plugin = hook.install("opencode", user=False, project=project)
+    mjs = tmp_path / "aegis-devops.mjs"  # ESM regardless of any package.json
+    mjs.write_text(plugin.read_text())
+    harness = tmp_path / "harness.mjs"
+    harness.write_text(HARNESS)
+    return {"home": home, "project": project, "plugin": mjs, "harness": harness}
+
+
+def _call(env, command, extra_env=None):
+    import os
+
+    proc_env = {**os.environ, **(extra_env or {})}
+    out = subprocess.run(
+        [NODE, str(env["harness"]), str(env["plugin"]), str(env["project"]), command],
+        capture_output=True, text=True, env=proc_env, check=True, timeout=60,
+    )
+    return json.loads(out.stdout.strip().splitlines()[-1])
+
+
+def test_not_opted_in_allows_everything(env):
+    assert _call(env, "kubectl delete nodes --all") == {"allowed": True}
+
+
+def test_opted_in_blocks_only_what_the_policy_blocks(env):
+    main(["init", str(env["project"] / ".aegis")])
+    assert _call(env, "ls -la") == {"allowed": True}
+    blocked = _call(env, "kubectl delete nodes --all")
+    assert blocked["allowed"] is False
+    assert "no-delete-nodes" in blocked["message"]
+
+
+def test_escalate_blocks_because_opencode_cannot_ask(env):
+    main(["init", str(env["project"] / ".aegis")])
+    result = _call(env, "argocd app delete app1")
+    assert result["allowed"] is False
+    assert "ESCALATE" in result["message"]
+
+
+def test_missing_aegis_blocks_only_infra_in_opted_in_projects(env):
+    missing = {"AEGIS_BIN": str(env["home"] / "no-such-aegis")}
+    assert _call(env, "kubectl delete nodes --all", missing) == {"allowed": True}
+    (env["project"] / ".aegis").mkdir()
+    blocked = _call(env, "kubectl get pods", missing)
+    assert blocked["allowed"] is False
+    assert "pip install aegis-devops" in blocked["message"]
+    assert _call(env, "ls -la", missing) == {"allowed": True}

{aegis_devops-0.1.4 → aegis_devops-0.1.6}/tests/test_plugins.py

@@ -1,5 +1,6 @@
-"""Packaging of the Claude Code and Copilot plugins, and the wrapper script
-they both run when ``aegis`` itself may be missing."""
+"""Packaging of the Claude Code plugin, the Copilot plugin and the Gemini CLI
+extension, and the wrapper script all three run when ``aegis`` itself may be
+missing."""
 
 import json
 import os
@@ -13,6 +14,7 @@ from aegis_core import __version__
 ROOT = Path(__file__).resolve().parent.parent
 WRAPPER = ROOT / "hooks" / "aegis-hook.sh"
 COPILOT = ROOT / "plugins" / "copilot"
+CLAUDE = ROOT / "plugins" / "claude"
 
 
 def test_copilot_plugin_manifest():
@@ -30,18 +32,52 @@ def test_copilot_plugin_hook_runs_the_wrapper():
     assert (COPILOT / "aegis-hook.sh").stat().st_mode & 0o111
 
 
-def test_copilot_wrapper_is_a_copy_of_the_claude_one():
+@pytest.mark.parametrize(
+    "copy", ["plugins/copilot/aegis-hook.sh", "plugins/claude/hooks/aegis-hook.sh"]
+)
+def test_plugin_wrappers_are_copies_of_the_root_one(copy):
     # a plugin can only ship files inside its own folder
-    assert (COPILOT / "aegis-hook.sh").read_bytes() == WRAPPER.read_bytes()
+    path = ROOT / copy
+    assert path.read_bytes() == WRAPPER.read_bytes()
+    assert path.stat().st_mode & 0o111
+
+
+def test_claude_marketplace_points_at_the_plugin_folder():
+    market = json.loads((ROOT / ".claude-plugin" / "marketplace.json").read_text())
+    [entry] = market["plugins"]
+    assert entry["name"] == "aegis-devops"
+    assert entry["source"] == "./plugins/claude"
+    manifest = json.loads((CLAUDE / ".claude-plugin" / "plugin.json").read_text())
+    assert manifest["name"] == entry["name"]
+    # the repo root is the Gemini extension now; no Claude plugin manifest there
+    assert not (ROOT / ".claude-plugin" / "plugin.json").exists()
 
 
 def test_claude_plugin_hook_runs_the_wrapper():
-    hooks = json.loads((ROOT / "hooks" / "hooks.json").read_text())
+    hooks = json.loads((CLAUDE / "hooks" / "hooks.json").read_text())
     [entry] = hooks["hooks"]["PreToolUse"]
     assert entry["matcher"] == "Bash"
     assert entry["hooks"][0]["command"] == '"${CLAUDE_PLUGIN_ROOT}"/hooks/aegis-hook.sh claude'
 
 
+def test_gemini_extension_manifest():
+    manifest = json.loads((ROOT / "gemini-extension.json").read_text())
+    assert manifest["name"] == "aegis-devops"
+    assert manifest["version"] == __version__
+
+
+def test_gemini_extension_hook_runs_the_wrapper():
+    # Gemini CLI reads an extension's hooks from hooks/hooks.json at its root;
+    # nothing else may live there (Gemini warns about unknown events)
+    hooks = json.loads((ROOT / "hooks" / "hooks.json").read_text())
+    assert set(hooks["hooks"]) == {"BeforeTool"}
+    [entry] = hooks["hooks"]["BeforeTool"]
+    assert entry["matcher"] == "run_shell_command"
+    [h] = entry["hooks"]
+    assert h["command"] == '"${extensionPath}${/}hooks${/}aegis-hook.sh" gemini'
+    assert h["timeout"] == 30000
+
+
 # --- the wrapper with no aegis installed --------------------------------------------