agentgovern 2.2.1__tar.gz → 2.3.0__tar.gz

{agentgovern-2.2.1 → agentgovern-2.3.0}/.gitignore

@@ -32,6 +32,13 @@ test-results/
 # Not project config — skills/ and agents/ under .claude/ remain tracked.
 .claude/settings.json
 .claude/settings.local.json
+# Backups of the above, which carry the same content and the same reason to stay
+# untracked. Added 2026-08-21: the exact-filename rules above do not match a
+# `.bak-*` sibling, so a pre-change backup sat untracked-but-not-ignored inside
+# the repo, where a `git add -A` would have staged it — and, with both `ask`
+# arrays now empty, without prompting.
+.claude/settings.json.bak-*
+.claude/settings.local.json.bak-*
 
 .vercel
 

{agentgovern-2.2.1 → agentgovern-2.3.0}/CHANGELOG.md

@@ -1,5 +1,107 @@
 # Changelog
 
+## 2.3.0 — release date is the `sdk-v2.3.0` tag's (prepared 2026-09-29)
+
+### Security — the Claude Code hook now sees every tool call, but only after you reinstall it (NAGT-187)
+
+Until this release, `agentgovern hook install` registered the hook for a fixed
+list of tools (ten in 2.2.1: `Bash`, `Write`, `Edit`, `MultiEdit`,
+`NotebookEdit`, `Read`, `Glob`, `Grep`, `WebFetch`, `WebSearch`). **A tool call
+through any other tool never reached the hook, so no policy was applied to
+it.** On Windows, Claude Code's `PowerShell` tool was one such tool: every
+content rule could be bypassed by routing a command through it.
+
+- The `PreToolUse` and `PostToolUse` matchers are now `*`: every tool,
+  including tools that do not exist yet.
+- `PowerShell` is classified like `Bash` (`execute` / `code_execution`).
+- A tool the hook has no classification for is recorded as
+  `action_type="unmapped_tool"`. Before, it was recorded as `"custom"`, the
+  value the SDK reserves for your own `track_action()` calls. **A policy that
+  relied on `"custom"` as a catch-all for unknown tools needs
+  `"unmapped_tool"` added.**
+- The bundled hook script is version 2.3.0.
+
+> **Action required for existing installs.** Upgrading the package does not
+> change a hook that is already installed. Until you reinstall it, the hook
+> keeps its old tool list:
+>
+> ```bash
+> pip install --upgrade agentgovern
+> agentgovern hook install --force   # repeat --capture-mode=minimal, --matcher or --python-command if you used them
+> agentgovern hook status            # no [DRIFT] lines once it is current
+> ```
+>
+> Then restart any running Claude Code session. `--force` writes the current
+> defaults and does not remember options from the earlier install, so pass
+> them again. Without `--capture-mode=minimal`, it turns a minimal install
+> into a full one.
+
+### Change — `hook install` tells you when an existing hook is stale (NAGT-200)
+
+Before, running `agentgovern hook install` against an existing hook said
+*"already installed"*, even when that hook was out of date. It now adds which
+matcher, timeout or script version differs from what this package would
+write, and says to re-run with `--force`. **It still does not upgrade the
+hook itself.** The exit code and every refusal are unchanged, and `--force`
+is still required to write anything.
+
+### Fix — `httpx` and `pydantic` are now required dependencies (NAGT-324)
+
+`pip install agentgovern` installed no dependencies at all. The package
+imported cleanly, but 13 of its 23 public names, including `ActionType`,
+`ActionStatus` and `AgentGovernClient`, were bound to `None`. `init()` raised
+a clear `ImportError`, so any documented integration failed loudly at
+startup. But `register_agent()`, `track_action()` and `shutdown()` return
+silently when the SDK is uninitialised, so an integration that skipped or
+swallowed `init()` recorded nothing and reported nothing.
+
+This affected every release from 0.2.0 through 2.2.1. LangChain and LangGraph
+users were unaffected in practice: `langchain-core` depends on both `httpx`
+and `pydantic`, so those extras' own dependencies supplied them.
+
+- `httpx>=0.27.0` and `pydantic>=2.10.0` are now unconditional dependencies.
+  A bare install now also brings in their own dependencies: `anyio`,
+  `certifi`, `h11`, `httpcore`, `idna`, `pydantic-core`, `annotated-types`,
+  `typing-extensions` and `typing-inspection`.
+- **`python-dotenv` is removed.** No module in the package ever imported it.
+  If you relied on `agentgovern[sdk]` to install it, add it directly.
+- The `[sdk]` extra is kept, now empty, so `pip install "agentgovern[sdk]"`,
+  `[langchain]` and `[langgraph]` keep working unchanged, with no pip warning.
+- The import guard still catches any `ImportError`, so the hook CLI keeps
+  working in a `pip install --no-deps` or half-installed environment. **What
+  changed is the message:** `init()` now reports the error that actually
+  occurred. Before, it always told you to install the `[sdk]` extra, even
+  when that extra was already installed and something else had failed.
+- `init()`'s docstring now says what the fail-silent promise covers
+  (AgentGovern being *unreachable* once initialised). It also says what it
+  does not cover (the SDK being absent or misconfigured), and why `init()`
+  should not be wrapped in a bare `except`.
+
+### Docs
+
+- The LangChain samples in this README are updated for langchain 1.x, which
+  removed `AgentExecutor` and `create_openai_tools_agent`. They now use
+  `langchain.agents.create_agent` and pass the handler as
+  `config={"callbacks": [handler]}`. A new test runs such an agent and
+  confirms the handler's callbacks fire.
+- New README section: *Upgrading an existing install*.
+
+### Internal (not part of the installed package)
+
+- A new release gate: the wheel is built, its declared dependencies are
+  checked, and it is installed into a clean environment and imported before
+  it is uploaded. This runs on every pull request and in the publish workflow
+  itself.
+- `langchain>=1.0.0` added to the `dev` extra, for the new test.
+- Test fixes that make the suite trustworthy rather than change behaviour:
+  - NAGT-280: a test that pinned the hook version to the stale literal
+    `2.1.0` is removed; the test that checks the snapshot against the
+    module's own version stays;
+  - NAGT-326: Stop-hook tests no longer assume the temp directory is inside
+    `$HOME`;
+  - NAGT-327: the buffer-cap test is deterministic, with no live flush thread
+    and no network.
+
 ## 2.2.1 — 2026-08-13
 
 ### Fix — `register_agent()` silently no-op'd when called immediately after `init()`, the SDK's own documented call pattern (STORY-109)

{agentgovern-2.2.1 → agentgovern-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgovern
-Version: 2.2.1
+Version: 2.3.0
 Summary: Compliance-as-code middleware for agentic AI workflows.
 Project-URL: Homepage, https://agentgovern.zirahn.com
 Project-URL: Repository, https://github.com/ahmedkhan-zirahn/agentgovern
@@ -20,40 +20,25 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Monitoring
 Requires-Python: >=3.9
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic>=2.10.0
 Provides-Extra: crewai
 Requires-Dist: crewai>=0.80.0; extra == 'crewai'
-Requires-Dist: httpx>=0.27.0; extra == 'crewai'
-Requires-Dist: pydantic>=2.10.0; extra == 'crewai'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'crewai'
 Provides-Extra: dev
-Requires-Dist: httpx>=0.27.0; extra == 'dev'
-Requires-Dist: pydantic>=2.10.0; extra == 'dev'
+Requires-Dist: langchain>=1.0.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0.0; extra == 'dev'
 Requires-Dist: pytest>=8.3.0; extra == 'dev'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'dev'
 Requires-Dist: respx>=0.21.0; extra == 'dev'
 Requires-Dist: ruff>=0.8.0; extra == 'dev'
 Provides-Extra: langchain
-Requires-Dist: httpx>=0.27.0; extra == 'langchain'
 Requires-Dist: langchain-core>=0.3.0; extra == 'langchain'
-Requires-Dist: pydantic>=2.10.0; extra == 'langchain'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'langchain'
 Provides-Extra: langgraph
-Requires-Dist: httpx>=0.27.0; extra == 'langgraph'
 Requires-Dist: langchain-core>=0.3.0; extra == 'langgraph'
 Requires-Dist: langgraph<2.0.0,>=0.2.0; extra == 'langgraph'
-Requires-Dist: pydantic>=2.10.0; extra == 'langgraph'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'langgraph'
 Provides-Extra: openai
-Requires-Dist: httpx>=0.27.0; extra == 'openai'
 Requires-Dist: openai>=1.50.0; extra == 'openai'
-Requires-Dist: pydantic>=2.10.0; extra == 'openai'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'openai'
 Provides-Extra: sdk
-Requires-Dist: httpx>=0.27.0; extra == 'sdk'
-Requires-Dist: pydantic>=2.10.0; extra == 'sdk'
-Requires-Dist: python-dotenv>=1.0.0; extra == 'sdk'
 Description-Content-Type: text/markdown
 
 # AgentGovern Python SDK
@@ -74,7 +59,7 @@ pip install "agentgovern[langchain]"
 
 ```python
 import agentgovern
-from langchain.agents import AgentExecutor, create_openai_tools_agent
+from langchain.agents import create_agent
 from langchain_openai import ChatOpenAI
 
 # 1. Initialize once at startup
@@ -94,12 +79,13 @@ agentgovern.register_agent(
 # 3. Get the callback handler — binds to credit-scoring-v2 automatically
 handler = agentgovern.instrument_langchain()
 
-# 4. Pass it to your AgentExecutor — no other changes needed
-llm = ChatOpenAI(model="gpt-4o")
-agent = create_openai_tools_agent(llm, tools, prompt)
-executor = AgentExecutor(agent=agent, tools=tools, callbacks=[handler])
+# 4. Build the agent and pass the handler via config — no other changes needed
+agent = create_agent(model=ChatOpenAI(model="gpt-4o"), tools=tools)
 
-result = executor.invoke({"input": "Evaluate loan application for customer #12345"})
+result = agent.invoke(
+    {"messages": [{"role": "user", "content": "Evaluate loan application for customer #12345"}]},
+    config={"callbacks": [handler]},
+)
 ```
 
 `instrument_langchain()` binds to the most recently registered agent. Every tool call,
@@ -154,8 +140,11 @@ agentgovern.register_agent("kyc-agent", name="KYC Agent")
 handler_fraud = agentgovern.instrument_langchain("fraud-detector")
 handler_kyc   = agentgovern.instrument_langchain("kyc-agent")
 
-fraud_executor = AgentExecutor(agent=..., tools=..., callbacks=[handler_fraud])
-kyc_executor   = AgentExecutor(agent=..., tools=..., callbacks=[handler_kyc])
+fraud_agent = create_agent(model=..., tools=...)
+kyc_agent   = create_agent(model=..., tools=...)
+
+fraud_agent.invoke(inputs, config={"callbacks": [handler_fraud]})
+kyc_agent.invoke(inputs, config={"callbacks": [handler_kyc]})
 ```
 
 ## Manual instrumentation (all frameworks)
@@ -206,8 +195,10 @@ Enable policy packs from the [AgentGovern dashboard](https://agentgovern.zirahn.
 ## Claude Code Hook
 
 The SDK ships a built-in CLI for installing the AgentGovern hook into Claude Code. The hook
-intercepts `PreToolUse` events and enforces your tenant policies in real time — before any
-write-class tool (`Bash`, `Write`, `Edit`, `MultiEdit`, `NotebookEdit`) executes.
+intercepts `PreToolUse` events for every tool call and enforces your tenant policies in real
+time — before the tool executes. A tool AgentGovern doesn't yet have a specific classification
+for is still captured and evaluated, tagged `action_type=unmapped_tool` rather than silently
+skipped.
 
 ### Install
 
@@ -219,6 +210,29 @@ This deploys the hook script to `~/.agentgovern/hook.py`, merges the correct ent
 `~/.claude/settings.json` (with an atomic backup), and prints instructions for any missing
 env vars.
 
+### Upgrading an existing install
+
+Upgrading the package does **not** update a hook that is already installed. `hook install`
+copies the hook script to `~/.agentgovern/hook.py` and writes its entries into
+`~/.claude/settings.json`, and a plain `agentgovern hook install` against an existing install
+reports it as already installed and changes nothing. After upgrading, reinstall with `--force`:
+
+```bash
+pip install --upgrade agentgovern     # or the extra you installed with, e.g. "agentgovern[langchain]"
+agentgovern hook install --force
+agentgovern hook status               # reports no [DRIFT] lines once the hook is current
+```
+
+`--force` writes the current defaults. It does not remember options from the earlier install: if
+you installed with `--capture-mode=minimal`, `--matcher` or `--python-command`, pass them again —
+`--force` without `--capture-mode=minimal` turns a minimal install into a full one.
+Your environment variables are not touched. Restart any running Claude Code session afterwards.
+
+**If your hook was installed by 2.2.1 or earlier, this step matters for coverage, not just
+freshness.** Those versions wrote a `PreToolUse` matcher naming a fixed list of tools (ten, in 2.2.1), so a call
+through any other tool (`PowerShell`, for example) never reached the hook. Starting with 2.3.0
+the matcher is `*`, every tool — but only once `hook install --force` has rewritten the entry.
+
 ### Required env vars
 
 ```bash

{agentgovern-2.2.1 → agentgovern-2.3.0}/README.md

@@ -16,7 +16,7 @@ pip install "agentgovern[langchain]"
 
 ```python
 import agentgovern
-from langchain.agents import AgentExecutor, create_openai_tools_agent
+from langchain.agents import create_agent
 from langchain_openai import ChatOpenAI
 
 # 1. Initialize once at startup
@@ -36,12 +36,13 @@ agentgovern.register_agent(
 # 3. Get the callback handler — binds to credit-scoring-v2 automatically
 handler = agentgovern.instrument_langchain()
 
-# 4. Pass it to your AgentExecutor — no other changes needed
-llm = ChatOpenAI(model="gpt-4o")
-agent = create_openai_tools_agent(llm, tools, prompt)
-executor = AgentExecutor(agent=agent, tools=tools, callbacks=[handler])
+# 4. Build the agent and pass the handler via config — no other changes needed
+agent = create_agent(model=ChatOpenAI(model="gpt-4o"), tools=tools)
 
-result = executor.invoke({"input": "Evaluate loan application for customer #12345"})
+result = agent.invoke(
+    {"messages": [{"role": "user", "content": "Evaluate loan application for customer #12345"}]},
+    config={"callbacks": [handler]},
+)
 ```
 
 `instrument_langchain()` binds to the most recently registered agent. Every tool call,
@@ -96,8 +97,11 @@ agentgovern.register_agent("kyc-agent", name="KYC Agent")
 handler_fraud = agentgovern.instrument_langchain("fraud-detector")
 handler_kyc   = agentgovern.instrument_langchain("kyc-agent")
 
-fraud_executor = AgentExecutor(agent=..., tools=..., callbacks=[handler_fraud])
-kyc_executor   = AgentExecutor(agent=..., tools=..., callbacks=[handler_kyc])
+fraud_agent = create_agent(model=..., tools=...)
+kyc_agent   = create_agent(model=..., tools=...)
+
+fraud_agent.invoke(inputs, config={"callbacks": [handler_fraud]})
+kyc_agent.invoke(inputs, config={"callbacks": [handler_kyc]})
 ```
 
 ## Manual instrumentation (all frameworks)
@@ -148,8 +152,10 @@ Enable policy packs from the [AgentGovern dashboard](https://agentgovern.zirahn.
 ## Claude Code Hook
 
 The SDK ships a built-in CLI for installing the AgentGovern hook into Claude Code. The hook
-intercepts `PreToolUse` events and enforces your tenant policies in real time — before any
-write-class tool (`Bash`, `Write`, `Edit`, `MultiEdit`, `NotebookEdit`) executes.
+intercepts `PreToolUse` events for every tool call and enforces your tenant policies in real
+time — before the tool executes. A tool AgentGovern doesn't yet have a specific classification
+for is still captured and evaluated, tagged `action_type=unmapped_tool` rather than silently
+skipped.
 
 ### Install
 
@@ -161,6 +167,29 @@ This deploys the hook script to `~/.agentgovern/hook.py`, merges the correct ent
 `~/.claude/settings.json` (with an atomic backup), and prints instructions for any missing
 env vars.
 
+### Upgrading an existing install
+
+Upgrading the package does **not** update a hook that is already installed. `hook install`
+copies the hook script to `~/.agentgovern/hook.py` and writes its entries into
+`~/.claude/settings.json`, and a plain `agentgovern hook install` against an existing install
+reports it as already installed and changes nothing. After upgrading, reinstall with `--force`:
+
+```bash
+pip install --upgrade agentgovern     # or the extra you installed with, e.g. "agentgovern[langchain]"
+agentgovern hook install --force
+agentgovern hook status               # reports no [DRIFT] lines once the hook is current
+```
+
+`--force` writes the current defaults. It does not remember options from the earlier install: if
+you installed with `--capture-mode=minimal`, `--matcher` or `--python-command`, pass them again —
+`--force` without `--capture-mode=minimal` turns a minimal install into a full one.
+Your environment variables are not touched. Restart any running Claude Code session afterwards.
+
+**If your hook was installed by 2.2.1 or earlier, this step matters for coverage, not just
+freshness.** Those versions wrote a `PreToolUse` matcher naming a fixed list of tools (ten, in 2.2.1), so a call
+through any other tool (`PowerShell`, for example) never reached the hook. Starting with 2.3.0
+the matcher is `*`, every tool — but only once `hook install --force` has rewritten the entry.
+
 ### Required env vars
 
 ```bash

{agentgovern-2.2.1 → agentgovern-2.3.0}/RELEASING.md

@@ -11,15 +11,17 @@ Before the first automated publish, configure trusted publishing on PyPI:
 
    | Field             | Value                        |
    |-------------------|------------------------------|
-   | Owner             | ahmedkhan-zirahn             |
+   | Owner             | ZirahnAI                     |
    | Repository name   | agentgovern                  |
    | Workflow filename | publish-sdk.yml              |
    | Environment name  | pypi                         |
 
+   **Note:** the repository moved from `ahmedkhan-zirahn` to `ZirahnAI` in September 2026. A publisher for the old owner existed and was **deleted on 2026-09-14**. A trusted publisher that names a path the organisation no longer controls is a standing binding to a namespace someone else could later claim. See NAGT-314 in `docs/ROADMAP.md`.
+
 3. Save. No API token needed after this.
 
 Also create the `pypi` environment in GitHub:
-- Go to https://github.com/ahmedkhan-zirahn/agentgovern/settings/environments
+- Go to https://github.com/ZirahnAI/agentgovern/settings/environments
 - Create environment named `pypi` (no protection rules required)
 
 ## Release steps
@@ -53,7 +55,7 @@ Also create the `pypi` environment in GitHub:
 
 If you need to publish without tagging (e.g., to re-publish after a failed run), trigger the workflow manually:
 
-1. Go to https://github.com/ahmedkhan-zirahn/agentgovern/actions/workflows/publish-sdk.yml
+1. Go to https://github.com/ZirahnAI/agentgovern/actions/workflows/publish-sdk.yml
 2. Click **Run workflow** → select branch `main` → **Run workflow**
 
 The manual run builds and publishes whatever version is currently in `packages/sdk-python/pyproject.toml`. Make sure the version in `pyproject.toml` and `_version.py` match before triggering.

{agentgovern-2.2.1 → agentgovern-2.3.0}/agentgovern/__init__.py

@@ -29,9 +29,23 @@ from typing import Any
 
 from agentgovern._version import __version__
 
-# SDK deps (httpx, pydantic) are optional — required only for agent SDK usage.
-# The hook CLI (agentgovern hook install/...) works with a bare install.
-# Install with: pip install agentgovern[sdk]
+# httpx and pydantic are REQUIRED dependencies (NAGT-324). A normal
+# `pip install agentgovern` always has them, so this guard is not the
+# optional-extra switch it used to be.
+#
+# It still exists for one case: an install that deliberately suppressed
+# dependency resolution (`pip install --no-deps`), or one that is broken or
+# half-finished. In those, the Claude Code hook CLI -- which is stdlib-only
+# all the way down -- must keep working, and it cannot, because importing
+# `agentgovern.__main__` imports THIS module first.
+#
+# The catch stays BROAD on purpose. Narrowing it to `_exc.name in ("httpx",
+# "pydantic")` was tried and withdrawn: ImportError.name is the INNERMOST
+# missing module, so a broken `pydantic_core` (a compiled wheel, and one of
+# pydantic's most common real failures) reports 'pydantic_core', gets
+# re-raised, and takes the hook CLI down in exactly the case this guard is
+# for. What was actually wrong was the DIAGNOSTIC, not the breadth -- so the
+# exception is recorded and `_require_sdk()` reports what really happened.
 try:
     from agentgovern.client import AgentGovernClient
     from agentgovern.exceptions import (
@@ -51,8 +65,10 @@ try:
     )
 
     _SDK_AVAILABLE = True
-except ImportError:
+    _SDK_IMPORT_ERROR: ImportError | None = None
+except ImportError as _exc:
     _SDK_AVAILABLE = False
+    _SDK_IMPORT_ERROR = _exc
     # Provide placeholder names so `from agentgovern import X` fails at call
     # time with a clear message rather than at import time.
     AgentGovernClient = None  # type: ignore[assignment,misc]
@@ -71,12 +87,29 @@ except ImportError:
 
 
 def _require_sdk() -> None:
+    """Raise if the SDK half of this package could not be imported.
+
+    The message is derived from the exception actually raised, never assumed.
+    Before NAGT-324 this always said "install agentgovern[sdk]", which was
+    wrong whenever the real cause was anything else -- it told people to
+    install a dependency that was, in those cases, already installed.
+    """
     if not _SDK_AVAILABLE:
+        _missing = getattr(_SDK_IMPORT_ERROR, "name", None)
+        if _missing in ("httpx", "pydantic"):
+            raise ImportError(
+                f"The AgentGovern SDK requires {_missing}, which is not "
+                f"importable. It is a declared dependency, so this usually "
+                f"means the install skipped dependency resolution "
+                f"(pip install --no-deps) or is incomplete. Reinstall with: "
+                f"pip install --force-reinstall agentgovern"
+            ) from _SDK_IMPORT_ERROR
         raise ImportError(
-            "The AgentGovern SDK requires additional dependencies. "
-            "Install them with: pip install agentgovern[sdk]\n"
-            "The hook CLI (agentgovern hook install) works without this extra."
-        )
+            f"The AgentGovern SDK failed to load: {_SDK_IMPORT_ERROR!r}. "
+            f"This is NOT a missing optional extra -- the installation is "
+            f"broken or incomplete. Reinstall with: "
+            f"pip install --force-reinstall agentgovern"
+        ) from _SDK_IMPORT_ERROR
 
 
 _client: AgentGovernClient | None = None
@@ -100,8 +133,17 @@ def init(
     Initialize the AgentGovern SDK.
 
     Must be called once at application startup before any other SDK calls.
-    The SDK is designed to never break the customer's agent — if AgentGovern
-    is unreachable, all errors are silently discarded.
+
+    The fail-silent contract covers AgentGovern being UNREACHABLE: once the
+    SDK is initialised, network errors, timeouts and policy-engine failures
+    are discarded rather than raised into your agent.
+
+    It does NOT cover AgentGovern being absent or misconfigured. This function
+    raises if the SDK's dependencies cannot be imported, and it is the only
+    place that failure is reported — do not wrap this call in a bare
+    ``except``. If it raises, the SDK is not installed correctly and no action
+    will be recorded; ``status()`` returns ``{"initialized": False}`` for as
+    long as that is true.
 
     Args:
         api_key: SDK ingest key from the dashboard.
@@ -110,7 +152,8 @@ def init(
         policy_engine_url: Render policy engine URL (Gate 1 evaluate/input).
             Defaults to ``AGENTGOVERN_POLICY_ENGINE_URL`` env var, then
             ``https://agentgovern.onrender.com``.
-        fail_silently: If ``True``, SDK errors never raise into your agent.
+        fail_silently: If ``True``, SDK errors never raise into your agent,
+            after initialisation. It does not affect this function.
     """
     _require_sdk()
     global _client  # noqa: PLW0603

agentgovern-2.3.0/agentgovern/_version.py

@@ -0,0 +1 @@
+__version__ = "2.3.0"

{agentgovern-2.2.1 → agentgovern-2.3.0}/agentgovern/hook/data/hook.py

@@ -30,6 +30,15 @@ invocation, bounded so retry can never meaningfully delay the invocation
 that's doing it. Permanently-abandoned events are recorded to
 ~/.agentgovern/outbox-dead/ rather than silently dropped.
 
+NAGT-187 (v2.3.0): the installer's PreToolUse/PostToolUse matchers are now
+"*" (every tool, including ones this script has no _TOOL_MAP entry for —
+see installer.py). A tool with no _TOOL_MAP entry is classified
+action_type="unmapped_tool", not "custom" — "custom" remains reserved for
+an SDK caller's own deliberate track_action() declaration, and blending an
+unrecognized tool into that bucket would have made it silently
+indistinguishable from an intentional customer choice, undetectable by any
+policy that isn't already scanning "custom" as a catch-all.
+
 See README.md for installation instructions.
 """
 from __future__ import annotations
@@ -48,7 +57,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-__version__ = "2.2.0"
+__version__ = "2.3.0"
 
 # ── Constants ──────────────────────────────────────────────────────────────────
 
@@ -102,6 +111,10 @@ _VALID_CAPTURE_MODES = {CAPTURE_MODE_MINIMAL, CAPTURE_MODE_ENRICHED}
 _TOOL_MAP: dict[str, tuple[str, str]] = {
     "Bash":              ("execute",    "code_execution"),
     "Execute":           ("execute",    "code_execution"),
+    # NAGT-187: Windows dual-shell environments register PowerShell as a
+    # distinct tool from Bash, not a substitute for it. Same capability
+    # class as Bash — same classification.
+    "PowerShell":        ("execute",    "code_execution"),
     "Read":              ("read",       "data_access"),
     "Glob":              ("read",       "data_access"),
     "Write":             ("write",      "file_operation"),
@@ -120,8 +133,18 @@ _TOOL_MAP: dict[str, tuple[str, str]] = {
     "PermissionRequest": ("execute",    "control_flow"),
 }
 
-# Unknown tools default to execute/custom — fail toward stricter policies.
-_FALLBACK: tuple[str, str] = ("execute", "custom")
+# NAGT-187: unknown tools default to execute/unmapped_tool, NOT
+# execute/custom. "custom" is the Agent SDK's own ActionType.CUSTOM — a
+# customer's deliberate declaration for their own action, used today in
+# several policy packs' broad applicable_action_types catch-alls (e.g.
+# interactive-ai-software-dev.yaml's IAID-SECRET-* rules). Routing an
+# unrecognized tool into that same bucket would make "a tool this script
+# has never heard of" indistinguishable from "a customer's intentional
+# custom action" — silently correct only by accident, for exactly as long
+# as every policy author remembers to include 'custom' in their scope.
+# 'unmapped_tool' is its own value precisely so it can be reasoned about,
+# scoped, and alerted on independently of what 'custom' means elsewhere.
+_FALLBACK: tuple[str, str] = ("execute", "unmapped_tool")
 
 
 # ── Logging ────────────────────────────────────────────────────────────────────
@@ -197,8 +220,10 @@ def map_tool_to_event(tool_name: str) -> tuple[str, str]:
     """Map a Claude Code tool_name to (tool_event_type, action_type).
 
     MCP tools (containing 'mcp__') always map to communicate/api_request.
-    Unknown tools fall back to execute/custom so they are not silently
-    excluded from write-focused policy rules.
+    Unknown tools (NAGT-187: reachable for real now that the installer's
+    matcher is "*", not a fixed tool-name list) fall back to
+    execute/unmapped_tool — an explicit, distinct classification a policy
+    can target directly, rather than being silently folded into 'custom'.
     """
     if "mcp__" in tool_name:
         return ("communicate", "api_request")

{agentgovern-2.2.1 → agentgovern-2.3.0}/agentgovern/hook/drift.py

@@ -132,6 +132,28 @@ def _read_hook_version(hook_script_path: Path) -> str | None:
     This function must never be called with a path derived from network
     input, an untrusted argument, or anything other than a hook-script path
     this installer itself controls.
+
+    CALLER SET, kept current deliberately (NAGT-200a security review). The
+    note above was written when the only reachable entry points were
+    `hook status` and `hook test` — commands run to INSPECT. `hook install`
+    (non-force, against an existing install) now reaches it too, via
+    installer._staleness_note, so the repair command executes the file it is
+    about to report on. The path argument is unchanged — still
+    _hook_target_path() — so the reasoning above transfers intact; what
+    changed is the ORDERING, and `--force`, the path that actually repairs,
+    is guarded by `if not args.force:` and never reaches here.
+
+    Recorded rather than left to be re-derived, because an accepted analysis
+    whose scope silently widens is how a correct security note becomes a
+    wrong one (NAGT-199). Any future caller added to this function belongs in
+    this list.
+
+    The benignity of executing today's hook.py is a PROPERTY, NOT AN
+    INVARIANT — it holds because that module has no side-effectful top-level
+    code. `packages/claude-hook/tests/test_hook.py` asserts that
+    (test_hook_module_has_no_side_effectful_top_level_code); if it ever fails,
+    this function starts triggering real side effects from `hook status` and
+    `hook install`, and the acceptance above no longer holds.
     """
     if not hook_script_path.exists():
         return None