conduct-cli 0.13.0__tar.gz → 0.14.0__tar.gz

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.13.0
+Version: 0.14.0
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.13.0"
+version = "0.14.0"
 description = "Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli/guard.py

@@ -471,7 +471,7 @@ def _patch_claude_desktop_proxy(api_url: str, agent_token: str) -> None:
     shell env vars, so ANTHROPIC_BASE_URL has no effect. We write the proxy
     URL directly so PII blocking, spend limits, and audit apply to Desktop too.
     """
-    proxy_url = f"{api_url}/proxy/anthropic"
+    proxy_url = f"{api_url.rstrip('/')}/gateway/v1/anthropic"
     candidates = [
         Path.home() / "Library" / "Application Support" / "Claude" / "claude_desktop_config.json",
         Path.home() / "AppData" / "Roaming" / "Claude" / "claude_desktop_config.json",
@@ -695,9 +695,35 @@ def _install_codex_hook(hook_path: Path) -> None:
 
     hook_section = hooks.setdefault("hooks", {})
 
+    hook_path_str = str(hook_path)
+    # Match the retired location only to delete stale registrations. The
+    # desired entry below always points at the current ~/.conduct/hook.py.
+    stale_hook_path = str(Path.home() / ".conductguard" / "hook.py")
+    conduct_hook_paths = {
+        hook_path_str,
+        str(Path.home() / ".conduct" / "hook.py"),
+        stale_hook_path,
+    }
+
+    def _is_conduct_hook(entry: dict) -> bool:
+        command = entry.get("command", "")
+        return any(path in command for path in conduct_hook_paths)
+
+    def _replace_conduct_entries(entries: list, command: str) -> tuple[list, bool]:
+        kept = []
+        removed = False
+        for registration in entries:
+            commands = registration.get("hooks", [])
+            filtered = [entry for entry in commands if not _is_conduct_hook(entry)]
+            if len(filtered) != len(commands):
+                removed = True
+            if filtered:
+                kept.append({**registration, "hooks": filtered})
+        desired = {"matcher": ".*", "hooks": [{"type": "command", "command": command}]}
+        return [*kept, desired], removed or entries != [*kept, desired]
+
     # PreToolUse
     pre_cmd = f"{_best_python()} {hook_path}"
-    hook_path_str = str(hook_path)
     pre = hook_section.setdefault("PreToolUse", [])
     # Match by hook path so old python3/python3.11 entries are treated as already registered
     pre_already = any(
@@ -706,16 +732,9 @@ def _install_codex_hook(hook_path: Path) -> None:
         for e in h.get("hooks", [])
     )
     changed = False
-    if not pre_already:
-        pre.append({"matcher": ".*", "hooks": [{"type": "command", "command": pre_cmd}]})
-        changed = True
-    else:
-        # Update existing entry to use current sys.executable
-        for h in pre:
-            for e in h.get("hooks", []):
-                if hook_path_str in e.get("command", "") and e["command"] != pre_cmd:
-                    e["command"] = pre_cmd
-                    changed = True
+    normalized_pre, pre_changed = _replace_conduct_entries(pre, pre_cmd)
+    hook_section["PreToolUse"] = normalized_pre
+    changed = pre_changed
 
     # PostToolUse
     post_cmd = f"{_best_python()} {hook_path} post"
@@ -734,9 +753,9 @@ def _install_codex_hook(hook_path: Path) -> None:
         for h in post
         for e in h.get("hooks", [])
     )
-    if not post_already:
-        post.append({"matcher": ".*", "hooks": [{"type": "command", "command": post_cmd}]})
-        changed = True
+    normalized_post, post_changed = _replace_conduct_entries(post, post_cmd)
+    hook_section["PostToolUse"] = normalized_post
+    changed = changed or post_changed
     if cleaned:
         changed = True
 
@@ -751,6 +770,36 @@ def _install_codex_hook(hook_path: Path) -> None:
         print(f"  {GRAY}Codex hooks already registered{RESET}")
 
 
+def _configure_codex_proxy(proxy_url: str) -> bool:
+    """Opt in Codex to Conduct's Responses endpoint without storing a secret."""
+    config_path = Path.home() / ".codex" / "config.toml"
+    if not config_path.parent.exists():
+        return False
+    content = config_path.read_text() if config_path.exists() else ""
+    backup = config_path.with_suffix(".toml.pre-conduct-proxy")
+    if config_path.exists() and not backup.exists():
+        backup.write_text(content)
+        backup.chmod(0o600)
+
+    import re as _re
+    sections = _re.split(r"(?m)(?=^\[)", content)
+    root = sections[0]
+    root = _re.sub(r'(?m)^model_provider\s*=.*\n?', '', root)
+    root = root.rstrip() + '\nmodel_provider = "conduct"\n\n'
+    remaining = [s for s in sections[1:] if not s.startswith("[model_providers.conduct]")]
+    base = proxy_url.rstrip("/") + "/openai/v1"
+    snippet = (
+        "[model_providers.conduct]\n"
+        'name = "Conduct Gateway"\n'
+        f"base_url = {json.dumps(base)}\n"
+        'env_key = "OPENAI_API_KEY"\n'
+        'wire_api = "responses"\n'
+        'requires_openai_auth = false\n\n'
+    )
+    config_path.write_text(root + snippet + "".join(remaining).lstrip())
+    return True
+
+
 # ── HTTP helpers (no third-party deps — mirrors api.py style) ─────────────────
 
 def _default_agent_token() -> str | None:
@@ -1520,7 +1569,8 @@ def cmd_guard_sync(args):
     # Write LLM proxy env vars so any AI tool (Claude Code, Cursor, Codex, …)
     # routes through Conduct Guard. Customer-overridable via --proxy-url or
     # CONDUCT_PROXY_URL env var; otherwise fetched from server (workspace_config).
-    proxy_url = getattr(args, "proxy_url", None) or os.environ.get("CONDUCT_PROXY_URL")
+    explicit_proxy_url = getattr(args, "proxy_url", None) or os.environ.get("CONDUCT_PROXY_URL")
+    proxy_url = explicit_proxy_url
     if not proxy_url:
         try:
             import urllib.request as _ur, urllib.error as _ue
@@ -1533,6 +1583,8 @@ def cmd_guard_sync(args):
                 proxy_url = json.loads(_resp.read()).get("conduct_proxy_url") or DEFAULT_PROXY_URL
         except Exception:
             proxy_url = DEFAULT_PROXY_URL
+    if not explicit_proxy_url:
+        proxy_url = _gateway_v1_url(proxy_url)
     agent_token = cfg.get("agent_token", "")
     rc_path, newly_sourced = _write_proxy_env(agent_token, proxy_url)
     if agent_token:
@@ -1541,6 +1593,11 @@ def cmd_guard_sync(args):
         print(f"  {GREEN}Proxy env written:{RESET} ~/.conduct/{env_name} → {proxy_url}")
         if newly_sourced:
             print(f"  {CYAN}Run `{activate_cmd}` (or open a new shell) to activate.{RESET}")
+    if not getattr(args, "no_codex_proxy", False):
+        if _configure_codex_proxy(proxy_url):
+            print(f"  {GREEN}Codex proxy enabled:{RESET} Responses API via Conduct (restart Codex)")
+        else:
+            print(f"  {YELLOW}Codex proxy skipped:{RESET} ~/.codex is not installed")
 
     _tools = _detect_ai_tools()
     if _tools:
@@ -1628,11 +1685,19 @@ def cmd_guard_sync(args):
 CONDUCT_DIR        = Path.home() / ".conduct"
 PROXY_ENV_FILE     = CONDUCT_DIR / "env"
 PROXY_OVERRIDE     = CONDUCT_DIR / "env-override"
-DEFAULT_PROXY_URL  = "https://api.conductai.ai/proxy"
+DEFAULT_PROXY_URL  = "https://api.conductai.ai/gateway/v1"
 SHELL_RC_MARKER    = "# Conduct Guard Proxy — managed by `conduct guard sync`"
 SHELL_SOURCE_LINE  = "[ -f ~/.conduct/env ] && . ~/.conduct/env"
 
 
+def _gateway_v1_url(proxy_url: str) -> str:
+    """Convert a legacy server proxy URL to the parallel gateway surface."""
+    base = proxy_url.rstrip("/")
+    if base.endswith("/proxy"):
+        return base[:-len("/proxy")] + "/gateway/v1"
+    return base
+
+
 # ── Local key audit ──────────────────────────────────────────────────────────
 # Patterns that match real provider keys (NOT our member tokens).
 # Tuples of (provider, regex). Compiled once at import.
@@ -1727,10 +1792,10 @@ def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bo
         SHELL_RC_MARKER,
         "# Edit ~/.conduct/env-override.ps1 to add your own vars — sourced after this file.",
         "",
-        f'$env:ANTHROPIC_BASE_URL = "{proxy}"',
+        f'$env:ANTHROPIC_BASE_URL = "{proxy}/anthropic"',
         f'$env:ANTHROPIC_API_KEY  = "{token}"',
         "",
-        f'$env:OPENAI_BASE_URL = "{proxy}/openai"',
+        f'$env:OPENAI_BASE_URL = "{proxy}/openai/v1"',
         f'$env:OPENAI_API_KEY  = "{token}"',
         "",
         f'$env:PERPLEXITY_BASE_URL = "{proxy}/perplexity"',
@@ -1796,10 +1861,10 @@ def _write_proxy_env(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
         SHELL_RC_MARKER,
         "# Edit ~/.conduct/env-override to add your own vars — sourced after this file.",
         "",
-        f'export ANTHROPIC_BASE_URL="{proxy}"',
+        f'export ANTHROPIC_BASE_URL="{proxy}/anthropic"',
         f'export ANTHROPIC_API_KEY="{token}"',
         "",
-        f'export OPENAI_BASE_URL="{proxy}/openai"',
+        f'export OPENAI_BASE_URL="{proxy}/openai/v1"',
         f'export OPENAI_API_KEY="{token}"',
         "",
         f'export PERPLEXITY_BASE_URL="{proxy}/perplexity"',
@@ -2152,14 +2217,27 @@ def cmd_guard_status(args):
     elif d_status == "stale":
         daemon_line = f"{YELLOW}stale{RESET} (pid {d_pid}, not flushing — will restart on next tool call)"
     else:
-        daemon_line = f"{RED}not running{RESET} — will start on next tool call, journal events queued"
+        daemon_line = f"{RED}not running{RESET} — will start on next tool call"
+
+    journal_dir = Path.home() / ".conduct" / "journal"
+    queued_events = len(list(journal_dir.glob("*.json"))) if journal_dir.exists() else 0
+    dead_events = len(list((journal_dir / "dead-letter").glob("*.json"))) if (journal_dir / "dead-letter").exists() else 0
+    heartbeat_path = Path.home() / ".conduct" / "hook-heartbeat.json"
+    heartbeat_line = "never observed"
+    try:
+        heartbeat = json.loads(heartbeat_path.read_text())
+        age = max(0, int(time.time() - float(heartbeat["ts"])))
+        heartbeat_line = f"{heartbeat.get('event', 'hook')} · {age}s ago"
+    except Exception:
+        pass
 
     # Proxy coverage — check active env vars in this shell
-    proxy_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/") + "/proxy"
     _env           = os.environ
-    anthropic_ok   = proxy_url in _env.get("ANTHROPIC_BASE_URL", "")
-    openai_ok      = proxy_url in _env.get("OPENAI_BASE_URL",    "")
-    perplexity_ok  = proxy_url in _env.get("PERPLEXITY_BASE_URL","")
+    def _conduct_proxy_url(value: str) -> bool:
+        return "api.conductai.ai" in value and ("/gateway/v1" in value or "/proxy" in value)
+    anthropic_ok   = _conduct_proxy_url(_env.get("ANTHROPIC_BASE_URL", ""))
+    openai_ok      = _conduct_proxy_url(_env.get("OPENAI_BASE_URL", ""))
+    perplexity_ok  = _conduct_proxy_url(_env.get("PERPLEXITY_BASE_URL", ""))
     env_file_exists = (Path.home() / ".conduct" / "env").exists()
 
     def _cov(ok: bool, name: str) -> str:
@@ -2185,6 +2263,8 @@ def cmd_guard_status(args):
     print()
     print(f"Proxy coverage: {proxy_line}")
     print(f"Drain daemon:   {daemon_line}")
+    print(f"Event journal:  {queued_events} queued · {dead_events} dead-letter")
+    print(f"Hook heartbeat: {heartbeat_line}")
     print()
     print(f"Today:")
     print(f"  Sessions: {session_str}")
@@ -2357,7 +2437,9 @@ def register_guard_parser(sub):
     sync_p.add_argument("--reset-instructions", action="store_true", dest="reset_instructions",
                         help="Remove ConductGuard blocks from all instruction files")
     sync_p.add_argument("--proxy-url", default=None,
-                        help="Override the Guard proxy URL (default: https://api.conductai.ai/proxy/anthropic)")
+                        help="Override the Guard gateway URL (default: https://api.conductai.ai/gateway/v1)")
+    sync_p.add_argument("--no-codex-proxy", action="store_true",
+                        help="Leave Codex model traffic on its current provider")
     sync_p.add_argument("--no-local-audit", action="store_true",
                         help="Skip the local pre-existing API key scan")
 

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli/hooks/base.py

@@ -28,7 +28,9 @@ VERSION_CACHE_TTL  = 60    # seconds
 WARNED_RULES_PATH  = GUARD_DIR / "warned_rules.json"
 SIGNING_KEY_PATH   = GUARD_DIR / "signing.key"
 JOURNAL_DIR        = GUARD_DIR / "journal"
+JOURNAL_DEAD_DIR   = JOURNAL_DIR / "dead-letter"
 JOURNAL_PID_PATH   = JOURNAL_DIR / "drain.pid"
+HOOK_HEARTBEAT_PATH = GUARD_DIR / "hook-heartbeat.json"
 
 SNAPSHOT_PATH    = GUARD_DIR / "session_snapshot.json"
 CONDUCT_ENV_PATH = Path.home() / ".conduct" / "env"
@@ -42,6 +44,18 @@ class HookResult:
     metadata: dict = field(default_factory=dict)
 
 
+def record_hook_heartbeat(event_name: str) -> None:
+    """Record local hook liveness without storing request or user data."""
+    try:
+        GUARD_DIR.mkdir(parents=True, exist_ok=True)
+        tmp = HOOK_HEARTBEAT_PATH.with_suffix(".tmp")
+        tmp.write_text(json.dumps({"event": event_name, "ts": time.time()}))
+        tmp.chmod(0o600)
+        tmp.replace(HOOK_HEARTBEAT_PATH)
+    except Exception:
+        pass
+
+
 # ── Config loading ────────────────────────────────────────────────────────────
 
 def load_config() -> dict:
@@ -155,11 +169,13 @@ def journal_append(payload_str: str, api_url: str) -> None:
     """Atomically write one event to the journal for the drain daemon to pick up."""
     try:
         JOURNAL_DIR.mkdir(parents=True, exist_ok=True)
+        JOURNAL_DIR.chmod(0o700)
         import random
         name = f"{time.time_ns()}_{random.randint(0, 9999):04d}.json"
-        entry = json.dumps({"api_url": api_url, "payload": payload_str})
+        entry = json.dumps({"api_url": api_url, "payload": payload_str, "attempts": 0})
         tmp = JOURNAL_DIR / (name + ".tmp")
         tmp.write_text(entry)
+        tmp.chmod(0o600)
         tmp.rename(JOURNAL_DIR / name)
     except Exception:
         pass
@@ -256,6 +272,7 @@ def run_drain_daemon() -> None:
     try:
         JOURNAL_DIR.mkdir(parents=True, exist_ok=True)
         JOURNAL_PID_PATH.write_text(str(_os.getpid()))
+        JOURNAL_PID_PATH.chmod(0o600)
     except Exception:
         return
     empty_scans = 0
@@ -268,6 +285,7 @@ def run_drain_daemon() -> None:
             continue
         posted_any = False
         for f in files:
+            entry: dict = {}
             try:
                 entry = json.loads(f.read_text())
                 api_url = entry["api_url"]
@@ -293,8 +311,29 @@ def run_drain_daemon() -> None:
                 urllib.request.urlopen(req, timeout=8)
                 f.unlink(missing_ok=True)
                 posted_any = True
-            except Exception:
-                pass
+            except Exception as exc:
+                attempts = int(entry.get("attempts", 0)) + 1
+                status = getattr(exc, "code", None)
+                permanent = isinstance(status, int) and 400 <= status < 500 and status not in (408, 429)
+                try:
+                    if permanent or attempts >= 5:
+                        JOURNAL_DEAD_DIR.mkdir(parents=True, exist_ok=True)
+                        JOURNAL_DEAD_DIR.chmod(0o700)
+                        entry["attempts"] = attempts
+                        entry["last_error"] = f"HTTP {status}" if status else type(exc).__name__
+                        destination = JOURNAL_DEAD_DIR / f.name
+                        destination.write_text(json.dumps(entry))
+                        destination.chmod(0o600)
+                        f.unlink(missing_ok=True)
+                    else:
+                        entry["attempts"] = attempts
+                        entry["last_error"] = f"HTTP {status}" if status else type(exc).__name__
+                        tmp = f.with_suffix(".tmp")
+                        tmp.write_text(json.dumps(entry))
+                        tmp.chmod(0o600)
+                        tmp.replace(f)
+                except Exception:
+                    pass
         if not posted_any:
             empty_scans += 1
             time.sleep(2)

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli/hooks/posttooluse.py

@@ -12,6 +12,7 @@ from conduct_cli.hooks.base import (
     detect_ai_tool,
     load_config,
     post_event,
+    record_hook_heartbeat,
     run_drain_daemon,
 )
 from conduct_cli.hooks.pretooluse import (
@@ -259,6 +260,7 @@ def main() -> None:
     except Exception:
         sys.exit(0)
 
+    record_hook_heartbeat("post_tool_use")
     _this_file    = Path(__file__).resolve()
     tool_name     = (data.get("tool_name") or "").lower()
     tool_use_id   = data.get("tool_use_id")

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli/hooks/pretooluse.py

@@ -30,6 +30,7 @@ from conduct_cli.hooks.base import (
     journal_append,
     load_config,
     post_event,
+    record_hook_heartbeat,
     run_drain_daemon,
 )
 
@@ -768,6 +769,7 @@ def main() -> None:
         data = json.load(sys.stdin)
     except Exception:
         sys.exit(0)
+    record_hook_heartbeat("pre_tool_use")
 
     # Stop hook — session ended, capture for team memory
     if data.get("hook_event_name") == "Stop" or data.get("stop_hook_active"):

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli/main.py

@@ -1409,7 +1409,6 @@ _FRIENDLY_NAMES = {
 
 def cmd_install_all(args):
     server, workspace_id, token = _require_auth(args)
-    hdrs = api.headers(workspace_id, token, "application/json")
 
     slugs = _ALL_SLUGS
 
@@ -1435,7 +1434,6 @@ def cmd_install_all(args):
         # Patch server/workspace/auth into the namespace so _require_auth works
         a.server    = server
         a.workspace = workspace_id
-        a.api_key   = api_key
         a.token     = token
 
         try:

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.13.0
+Version: 0.14.0
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/src/conduct_cli.egg-info/SOURCES.txt

@@ -39,7 +39,9 @@ tests/test_guard_approvals.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py
 tests/test_hook_dispatch.py
+tests/test_hook_journal.py
 tests/test_hook_receipt.py
+tests/test_install_all.py
 tests/test_instruction_files.py
 tests/test_journal_drain.py
 tests/test_log_util.py

conduct_cli-0.14.0/tests/test_hook_journal.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+import json
+import os
+from urllib.error import HTTPError
+
+from conduct_cli.hooks import base
+
+
+def _redirect_journal(tmp_path, monkeypatch):
+    journal = tmp_path / "journal"
+    monkeypatch.setattr(base, "JOURNAL_DIR", journal)
+    monkeypatch.setattr(base, "JOURNAL_DEAD_DIR", journal / "dead-letter")
+    monkeypatch.setattr(base, "JOURNAL_PID_PATH", journal / "drain.pid")
+    monkeypatch.setattr(base.time, "sleep", lambda _seconds: None)
+    return journal
+
+
+def test_permanent_delivery_failure_moves_event_to_dead_letter(tmp_path, monkeypatch):
+    journal = _redirect_journal(tmp_path, monkeypatch)
+    base.journal_append(json.dumps({"workspace_id": "workspace"}), "https://api.test")
+
+    def _fail(*args, **kwargs):
+        raise HTTPError("https://api.test", 400, "bad request", {}, None)
+
+    monkeypatch.setattr(base.urllib.request, "urlopen", _fail)
+    base.run_drain_daemon()
+
+    assert not list(journal.glob("*.json"))
+    dead = list((journal / "dead-letter").glob("*.json"))
+    assert len(dead) == 1
+    if os.name != "nt":
+        assert dead[0].stat().st_mode & 0o077 == 0
+    entry = json.loads(dead[0].read_text())
+    assert entry["attempts"] == 1
+    assert entry["last_error"] == "HTTP 400"
+
+
+def test_successful_delivery_removes_event(tmp_path, monkeypatch):
+    journal = _redirect_journal(tmp_path, monkeypatch)
+    base.journal_append(json.dumps({"workspace_id": "workspace"}), "https://api.test")
+
+    class _Ok:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            pass
+
+    monkeypatch.setattr(base.urllib.request, "urlopen", lambda *args, **kwargs: _Ok())
+    base.run_drain_daemon()
+    assert not list(journal.glob("*.json"))
+
+
+def test_hook_heartbeat_contains_no_request_data(tmp_path, monkeypatch):
+    heartbeat = tmp_path / "heartbeat.json"
+    monkeypatch.setattr(base, "HOOK_HEARTBEAT_PATH", heartbeat)
+    monkeypatch.setattr(base, "GUARD_DIR", tmp_path)
+    base.record_hook_heartbeat("post_tool_use")
+    data = json.loads(heartbeat.read_text())
+    assert data["event"] == "post_tool_use"
+    assert set(data) == {"event", "ts"}
+    if os.name != "nt":
+        assert heartbeat.stat().st_mode & 0o077 == 0

conduct_cli-0.14.0/tests/test_install_all.py

@@ -0,0 +1,24 @@
+from types import SimpleNamespace
+
+from conduct_cli import main as cli
+
+
+def test_install_all_forwards_authenticated_token_to_every_install(monkeypatch):
+    installed = []
+    token = "cond_agt_test"
+
+    monkeypatch.setattr(
+        cli,
+        "_require_auth",
+        lambda _args: ("https://api.example.test", "workspace-id", token),
+    )
+    monkeypatch.setattr(cli, "cmd_install", installed.append)
+
+    cli.cmd_install_all(
+        SimpleNamespace(project="Smoke Test", repo="owner/repo", input=[])
+    )
+
+    assert [args.slug for args in installed] == cli._ALL_SLUGS
+    assert all(args.server == "https://api.example.test" for args in installed)
+    assert all(args.workspace == "workspace-id" for args in installed)
+    assert all(args.token == token for args in installed)

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/tests/test_proxy_coverage.py

@@ -41,7 +41,7 @@ _PROXY = "https://api.conductai.ai/proxy"
 def test_all_three_active():
     env = {
         "ANTHROPIC_BASE_URL":  _PROXY,
-        "OPENAI_BASE_URL":     f"{_PROXY}/openai",
+        "OPENAI_BASE_URL":     f"{_PROXY}/openai/v1",
         "PERPLEXITY_BASE_URL": f"{_PROXY}/perplexity",
     }
     line = _run_coverage_block(env, _CFG)

{conduct_cli-0.13.0 → conduct_cli-0.14.0}/tests/test_proxy_env.py

@@ -8,6 +8,7 @@ Validates:
 from __future__ import annotations
 
 import os
+import json
 import sys
 from pathlib import Path
 from unittest import mock
@@ -38,9 +39,9 @@ def test_env_file_written_with_all_three_pairs(tmp_path, monkeypatch):
     rc, sourced = guard._write_proxy_env("abc123", "https://api.conductai.ai/proxy")
 
     env = (tmp_path / ".conduct" / "env").read_text()
-    assert 'export ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy"' in env
+    assert 'export ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy/anthropic"' in env
     assert 'export ANTHROPIC_API_KEY="abc123"' in env
-    assert 'export OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai"' in env
+    assert 'export OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai/v1"' in env
     assert 'export OPENAI_API_KEY="abc123"' in env
     assert 'export PERPLEXITY_BASE_URL="https://api.conductai.ai/proxy/perplexity"' in env
     assert 'export PERPLEXITY_API_KEY="abc123"' in env
@@ -90,8 +91,8 @@ def test_override_url_picked_up(tmp_path, monkeypatch):
 
     guard._write_proxy_env("abc", "https://my-self-hosted.example.com/proxy")
     env = (tmp_path / ".conduct" / "env").read_text()
-    assert 'ANTHROPIC_BASE_URL="https://my-self-hosted.example.com/proxy"' in env
-    assert 'OPENAI_BASE_URL="https://my-self-hosted.example.com/proxy/openai"' in env
+    assert 'ANTHROPIC_BASE_URL="https://my-self-hosted.example.com/proxy/anthropic"' in env
+    assert 'OPENAI_BASE_URL="https://my-self-hosted.example.com/proxy/openai/v1"' in env
 
 
 @pytestmark_posix
@@ -101,8 +102,63 @@ def test_env_file_strips_trailing_slash(tmp_path, monkeypatch):
 
     guard._write_proxy_env("abc", "https://api.conductai.ai/proxy/")
     env = (tmp_path / ".conduct" / "env").read_text()
-    assert 'ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy"' in env   # no trailing slash
-    assert 'OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai"' in env
+    assert 'ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy/anthropic"' in env
+    assert 'OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai/v1"' in env
+
+
+def test_fetched_legacy_proxy_url_maps_to_gateway_v1():
+    assert guard._gateway_v1_url("https://api.conductai.ai/proxy") == "https://api.conductai.ai/gateway/v1"
+    assert guard._gateway_v1_url("http://localhost:8000/gateway/v1") == "http://localhost:8000/gateway/v1"
+
+
+def test_configure_codex_proxy_is_secret_free(tmp_path, monkeypatch):
+    monkeypatch.setattr(guard.Path, "home", lambda: tmp_path)
+    codex = tmp_path / ".codex"
+    codex.mkdir()
+    config = codex / "config.toml"
+    config.write_text('model = "gpt-test"\n')
+
+    assert guard._configure_codex_proxy("https://api.conductai.ai/gateway/v1")
+    written = config.read_text()
+    assert 'model_provider = "conduct"' in written
+    assert 'base_url = "https://api.conductai.ai/gateway/v1/openai/v1"' in written
+    assert 'wire_api = "responses"' in written
+    assert "cond_agt_" not in written
+    assert config.with_suffix(".toml.pre-conduct-proxy").exists()
+
+
+def test_codex_hook_install_collapses_duplicate_conduct_entries(tmp_path, monkeypatch):
+    monkeypatch.setattr(guard.Path, "home", lambda: tmp_path)
+    monkeypatch.setattr(guard, "_best_python", lambda: "/usr/bin/python3")
+    codex = tmp_path / ".codex"
+    codex.mkdir()
+    hook_path = tmp_path / ".conduct" / "hook.py"
+    stale_hook_path = tmp_path / ".conductguard" / "hook.py"
+    hooks_path = codex / "hooks.json"
+    duplicate = {"matcher": ".*", "hooks": [{"type": "command", "command": f"python3 {hook_path}"}]}
+    stale = {"matcher": ".*", "hooks": [{"type": "command", "command": f"python3 {stale_hook_path}"}]}
+    unrelated = {"matcher": "Read", "hooks": [{"type": "command", "command": "other-hook"}]}
+    hooks_path.write_text(json.dumps({"hooks": {
+        "PreToolUse": [duplicate, duplicate, stale, unrelated],
+        "PostToolUse": [duplicate, duplicate, stale],
+    }}))
+
+    guard._install_codex_hook(hook_path)
+    installed = json.loads(hooks_path.read_text())["hooks"]
+    for event in ("PreToolUse", "PostToolUse"):
+        commands = [
+            item["command"]
+            for registration in installed[event]
+            for item in registration["hooks"]
+        ]
+        conduct_commands = [
+            command
+            for command in commands
+            if str(hook_path) in command
+        ]
+        assert len(conduct_commands) == 1
+        assert all(str(stale_hook_path) not in command for command in commands)
+    assert installed["PreToolUse"][0] == unrelated
 
 
 @pytestmark_posix
@@ -136,9 +192,9 @@ def test_windows_writes_ps1_env_file(tmp_path, monkeypatch):
     ps1 = tmp_path / ".conduct" / "env.ps1"
     assert ps1.exists()
     text = ps1.read_text()
-    assert '$env:ANTHROPIC_BASE_URL = "https://api.conductai.ai/proxy"' in text
+    assert '$env:ANTHROPIC_BASE_URL = "https://api.conductai.ai/proxy/anthropic"' in text
     assert '$env:ANTHROPIC_API_KEY  = "abc123"' in text
-    assert '$env:OPENAI_BASE_URL = "https://api.conductai.ai/proxy/openai"' in text
+    assert '$env:OPENAI_BASE_URL = "https://api.conductai.ai/proxy/openai/v1"' in text
     assert '$env:OPENAI_API_KEY  = "abc123"' in text
     assert '$env:PERPLEXITY_BASE_URL = "https://api.conductai.ai/proxy/perplexity"' in text
     assert '$env:PERPLEXITY_API_KEY  = "abc123"' in text
@@ -186,7 +242,7 @@ def test_is_anthropic_proxied_falls_back_to_env_file(tmp_path, monkeypatch):
     monkeypatch.delenv("ANTHROPIC_BASE_URL", raising=False)
     (tmp_path / ".conduct").mkdir(exist_ok=True)
     (tmp_path / ".conduct" / "env").write_text(
-        'export ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy"\n'
+        'export ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy/anthropic"\n'
         'export ANTHROPIC_API_KEY="cond_agt_test"\n'
     )
     assert guard._is_anthropic_proxied() is True
@@ -198,7 +254,7 @@ def test_is_openai_proxied_falls_back_to_env_file(tmp_path, monkeypatch):
     monkeypatch.delenv("OPENAI_BASE_URL", raising=False)
     (tmp_path / ".conduct").mkdir(exist_ok=True)
     (tmp_path / ".conduct" / "env").write_text(
-        'export OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai"\n'
+        'export OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai/v1"\n'
     )
     assert guard._is_openai_proxied() is True