conduct-cli 0.14.3__tar.gz → 0.14.5__tar.gz

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.3
+Version: 0.14.5
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.14.3"
+version = "0.14.5"
 description = "Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/src/conduct_cli/guard.py

@@ -1813,6 +1813,7 @@ def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bo
         "",
         f'$env:ANTHROPIC_BASE_URL = "{proxy}/anthropic"',
         f'$env:ANTHROPIC_API_KEY  = "{token}"',
+        '$env:CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1"',
         "",
         f'$env:OPENAI_BASE_URL = "{proxy}/openai/v1"',
         f'$env:OPENAI_API_KEY  = "{token}"',
@@ -1879,6 +1880,7 @@ def _write_proxy_env(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
         "",
         f'export ANTHROPIC_BASE_URL="{proxy}/anthropic"',
         f'export ANTHROPIC_API_KEY="{token}"',
+        'export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY="1"',
         "",
         f'export OPENAI_BASE_URL="{proxy}/openai/v1"',
         f'export OPENAI_API_KEY="{token}"',

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/src/conduct_cli/hooks/posttooluse.py

@@ -301,6 +301,20 @@ def main() -> None:
                 if action == "warn" and session_id and rule_id:
                     _record_session_warn(session_id, rule_id)
                 post_event(tool_name, {}, decision, rule_id, message, session_id, drain_via=_this_file, blast_radius=blast_radius)
+    elif session_id:
+        # Some Codex clients omit transcript_path. Still send the PostToolUse
+        # update so the pre-tool audit row is correlated and execution status
+        # is visible; token backfill can remain unavailable for this call.
+        _post_usage(
+            session_id,
+            tool_name or "unknown",
+            0,
+            0,
+            None,
+            blast_radius,
+            execution_status,
+            result_summary,
+        )
 
     sys.exit(0)
 

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/src/conduct_cli/hooks/session_start.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -18,6 +19,11 @@ from conduct_cli.hooks.base import (
 
 MAX_AGE_HOURS = 2
 
+_PROXY_TOKEN_RE = re.compile(
+    r"^\s*(?:export\s+)?ANTHROPIC_API_KEY\s*=\s*['\"]?(?:cond_agt_|guard-mt-)[A-Za-z0-9_-]+['\"]?\s*$",
+    re.MULTILINE,
+)
+
 
 def _check_proxy_token() -> None:
     """Warn + alert server if the proxy token is missing, malformed, or expired.
@@ -31,10 +37,7 @@ def _check_proxy_token() -> None:
         return
     env_text = CONDUCT_ENV_PATH.read_text()
     has_base_url    = "ANTHROPIC_BASE_URL=" in env_text
-    has_valid_token = (
-        'ANTHROPIC_API_KEY="guard-mt-' in env_text
-        or "ANTHROPIC_API_KEY='guard-mt-" in env_text
-    )
+    has_valid_token = bool(_PROXY_TOKEN_RE.search(env_text))
     if not has_base_url:
         return
 

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.3
+Version: 0.14.5
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/src/conduct_cli.egg-info/SOURCES.txt

@@ -51,6 +51,7 @@ tests/test_pretooluse_check_policy.py
 tests/test_proxy_coverage.py
 tests/test_proxy_env.py
 tests/test_report_tool_coverage.py
+tests/test_session_start.py
 tests/test_signed_policy.py
 tests/test_switch.py
 tests/test_token_lifecycle.py

{conduct_cli-0.14.3 → conduct_cli-0.14.5}/tests/test_proxy_env.py

@@ -41,6 +41,7 @@ def test_env_file_written_with_all_three_pairs(tmp_path, monkeypatch):
     env = (tmp_path / ".conduct" / "env").read_text()
     assert 'export ANTHROPIC_BASE_URL="https://api.conductai.ai/proxy/anthropic"' in env
     assert 'export ANTHROPIC_API_KEY="abc123"' in env
+    assert 'export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY="1"' in env
     assert 'export OPENAI_BASE_URL="https://api.conductai.ai/proxy/openai/v1"' in env
     assert 'export OPENAI_API_KEY="abc123"' in env
     assert 'export PERPLEXITY_BASE_URL="https://api.conductai.ai/proxy/perplexity"' in env
@@ -131,6 +132,19 @@ def test_fetched_legacy_proxy_url_maps_to_gateway_v1():
     assert guard._gateway_v1_url("http://localhost:8000/gateway/v1") == "http://localhost:8000/gateway/v1"
 
 
+@pytestmark_posix
+def test_canonical_gateway_env_contains_exact_openai_and_anthropic_surfaces(tmp_path, monkeypatch):
+    _redirect_home(tmp_path, monkeypatch)
+    monkeypatch.setenv("SHELL", "/bin/zsh")
+
+    guard._write_proxy_env("agent-token", "https://api.conductai.ai/gateway/v1")
+
+    env = (tmp_path / ".conduct" / "env").read_text()
+    assert 'export ANTHROPIC_BASE_URL="https://api.conductai.ai/gateway/v1/anthropic"' in env
+    assert 'export OPENAI_BASE_URL="https://api.conductai.ai/gateway/v1/openai/v1"' in env
+    assert 'export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY="1"' in env
+
+
 def test_configure_codex_proxy_is_secret_free(tmp_path, monkeypatch):
     monkeypatch.setattr(guard.Path, "home", lambda: tmp_path)
     codex = tmp_path / ".codex"
@@ -214,6 +228,7 @@ def test_windows_writes_ps1_env_file(tmp_path, monkeypatch):
     text = ps1.read_text()
     assert '$env:ANTHROPIC_BASE_URL = "https://api.conductai.ai/proxy/anthropic"' in text
     assert '$env:ANTHROPIC_API_KEY  = "abc123"' in text
+    assert '$env:CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1"' in text
     assert '$env:OPENAI_BASE_URL = "https://api.conductai.ai/proxy/openai/v1"' in text
     assert '$env:OPENAI_API_KEY  = "abc123"' in text
     assert '$env:PERPLEXITY_BASE_URL = "https://api.conductai.ai/proxy/perplexity"' in text

conduct_cli-0.14.5/tests/test_session_start.py

@@ -0,0 +1,40 @@
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from conduct_cli.hooks import session_start
+
+
+@pytest.mark.parametrize("token", ["cond_agt_current-token", "guard-mt-legacy-token"])
+def test_proxy_token_check_accepts_current_and_legacy_tokens(tmp_path, monkeypatch, capsys, token):
+    env_path = tmp_path / "env"
+    env_path.write_text(
+        "export ANTHROPIC_BASE_URL=\"https://api.conductai.ai/gateway/v1/anthropic\"\n"
+        f"export ANTHROPIC_API_KEY=\"{token}\"\n"
+    )
+    monkeypatch.setattr(session_start, "CONDUCT_ENV_PATH", env_path)
+    monkeypatch.setattr(
+        session_start,
+        "load_config",
+        lambda: {"token_expires_at": (datetime.now(timezone.utc) + timedelta(hours=1)).isoformat()},
+    )
+    monkeypatch.setattr(session_start, "post_event", lambda *args, **kwargs: pytest.fail("unexpected warning"))
+
+    session_start._check_proxy_token()
+
+    assert "missing or malformed" not in capsys.readouterr().out
+
+
+def test_proxy_token_check_warns_for_malformed_token(tmp_path, monkeypatch, capsys):
+    env_path = tmp_path / "env"
+    env_path.write_text(
+        "export ANTHROPIC_BASE_URL=\"https://api.conductai.ai/gateway/v1/anthropic\"\n"
+        "export ANTHROPIC_API_KEY=\"not-a-conduct-token\"\n"
+    )
+    monkeypatch.setattr(session_start, "CONDUCT_ENV_PATH", env_path)
+    monkeypatch.setattr(session_start, "load_config", lambda: {})
+    monkeypatch.setattr(session_start, "post_event", lambda *args, **kwargs: None)
+
+    session_start._check_proxy_token()
+
+    assert "proxy token missing or malformed" in capsys.readouterr().out