conduct-cli 0.14.0__tar.gz → 0.14.1__tar.gz

{conduct_cli-0.14.0 → conduct_cli-0.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.0
+Version: 0.14.1
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.0 → conduct_cli-0.14.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.14.0"
+version = "0.14.1"
 description = "Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{conduct_cli-0.14.0 → conduct_cli-0.14.1}/src/conduct_cli/guard.py

@@ -1781,6 +1781,24 @@ def _post_local_findings(cfg: dict, base_url: str, findings: list[dict]) -> None
         print(f"  {YELLOW}Audit upload skipped: {e}{RESET}")
 
 
+_LEGACY_CLAUDE_BYPASSES = {
+    "alias claude='env -u ANTHROPIC_BASE_URL claude'",
+    (
+        "function claude { "
+        "$prev=$env:ANTHROPIC_BASE_URL; $env:ANTHROPIC_BASE_URL=$null; "
+        "try { & claude @args } finally { $env:ANTHROPIC_BASE_URL=$prev } }"
+    ),
+}
+
+
+def _remove_legacy_claude_bypass(content: str) -> str:
+    """Remove only proxy-bypass aliases previously generated by Conduct."""
+    return "".join(
+        line for line in content.splitlines(keepends=True)
+        if line.strip() not in _LEGACY_CLAUDE_BYPASSES
+    )
+
+
 def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
     """Windows equivalent of _write_proxy_env — PowerShell profile + env.ps1."""
     CONDUCT_DIR.mkdir(parents=True, exist_ok=True)
@@ -1814,16 +1832,14 @@ def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bo
         rc = wps5_profile
 
     existing = rc.read_text() if rc.exists() else ""
-    CLAUDE_ALIAS = (
-        "function claude { "
-        "$prev=$env:ANTHROPIC_BASE_URL; $env:ANTHROPIC_BASE_URL=$null; "
-        "try { & claude @args } finally { $env:ANTHROPIC_BASE_URL=$prev } }"
-    )
+    cleaned = _remove_legacy_claude_bypass(existing)
+    bypass_removed = cleaned != existing
+    existing = cleaned
     PS_SOURCE_LINE = 'if (Test-Path "$HOME/.conduct/env.ps1") { . "$HOME/.conduct/env.ps1" }'
 
     if SHELL_RC_MARKER in existing:
-        if CLAUDE_ALIAS not in existing:
-            rc.write_text(existing.rstrip() + f"\n{CLAUDE_ALIAS}\n")
+        if bypass_removed:
+            rc.write_text(existing)
             return rc, True
         return rc, False
 
@@ -1831,7 +1847,6 @@ def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bo
     addition = (
         f"\n\n{SHELL_RC_MARKER}\n"
         f"{PS_SOURCE_LINE}\n"
-        f"{CLAUDE_ALIAS}\n"
     )
     rc.write_text(existing.rstrip() + addition if existing else addition.lstrip())
     return rc, True
@@ -1889,22 +1904,20 @@ def _write_proxy_env(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
         return Path(), False
 
     existing = rc.read_text() if rc.exists() else ""
-    CLAUDE_ALIAS = "alias claude='env -u ANTHROPIC_BASE_URL claude'"
+    cleaned = _remove_legacy_claude_bypass(existing)
+    bypass_removed = cleaned != existing
+    existing = cleaned
 
     if SHELL_RC_MARKER in existing:
-        # Already installed — patch in the alias if missing (upgrade path)
-        if CLAUDE_ALIAS not in existing:
-            rc.write_text(existing.rstrip() + f"\n{CLAUDE_ALIAS}\n")
+        if bypass_removed:
+            rc.write_text(existing)
             return rc, True
         return rc, False
 
     rc.parent.mkdir(parents=True, exist_ok=True)
-    # ponytail: alias strips ANTHROPIC_BASE_URL so Claude Code auth isn't routed
-    # through the Guard proxy (Claude Code governs agents; it isn't one)
     addition = (
         f"\n\n{SHELL_RC_MARKER}\n"
         f"{SHELL_SOURCE_LINE}\n"
-        f"{CLAUDE_ALIAS}\n"
     )
     rc.write_text(existing.rstrip() + addition if existing else addition.lstrip())
     return rc, True

{conduct_cli-0.14.0 → conduct_cli-0.14.1}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.0
+Version: 0.14.1
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.0 → conduct_cli-0.14.1}/tests/test_proxy_env.py

@@ -61,6 +61,26 @@ def test_shell_rc_source_line_added_once_across_multiple_syncs(tmp_path, monkeyp
     rc_text = (tmp_path / ".zshrc").read_text()
     assert rc_text.count(guard.SHELL_RC_MARKER) == 1
     assert rc_text.count(guard.SHELL_SOURCE_LINE) == 1
+    assert "env -u ANTHROPIC_BASE_URL" not in rc_text
+
+
+@pytestmark_posix
+def test_sync_removes_generated_claude_proxy_bypass(tmp_path, monkeypatch):
+    _redirect_home(tmp_path, monkeypatch)
+    monkeypatch.setenv("SHELL", "/bin/zsh")
+    zshrc = tmp_path / ".zshrc"
+    custom_alias = "alias claude-work='claude --worktree'"
+    zshrc.write_text(
+        f"{custom_alias}\n{guard.SHELL_RC_MARKER}\n{guard.SHELL_SOURCE_LINE}\n"
+        "alias claude='env -u ANTHROPIC_BASE_URL claude'\n"
+    )
+
+    _, changed = guard._write_proxy_env("abc", "https://api.conductai.ai/gateway/v1")
+
+    content = zshrc.read_text()
+    assert changed is True
+    assert "env -u ANTHROPIC_BASE_URL" not in content
+    assert custom_alias in content
 
 
 @pytestmark_posix
@@ -212,6 +232,20 @@ def test_windows_appends_source_line_to_powershell_profile_once(tmp_path, monkey
     text = profile.read_text()
     assert text.count(guard.SHELL_RC_MARKER) == 1
     assert text.count('. "$HOME/.conduct/env.ps1"') == 1
+    assert "$env:ANTHROPIC_BASE_URL=$null" not in text
+
+
+def test_windows_sync_removes_generated_claude_proxy_bypass(tmp_path, monkeypatch):
+    _redirect_home_windows(tmp_path, monkeypatch)
+    profile = tmp_path / "Documents" / "PowerShell" / "Microsoft.PowerShell_profile.ps1"
+    profile.parent.mkdir(parents=True)
+    bypass = next(value for value in guard._LEGACY_CLAUDE_BYPASSES if value.startswith("function claude"))
+    profile.write_text(f"{guard.SHELL_RC_MARKER}\n{bypass}\n")
+
+    _, changed = guard._write_proxy_env("abc", "https://api.conductai.ai/gateway/v1")
+
+    assert changed is True
+    assert "$env:ANTHROPIC_BASE_URL=$null" not in profile.read_text()
 
 
 def test_windows_prefers_ps7_profile_when_no_wps5_exists(tmp_path, monkeypatch):