conduct-cli 0.14.4__tar.gz → 0.14.6__tar.gz

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.4
+Version: 0.14.6
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.14.4"
+version = "0.14.6"
 description = "Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/src/conduct_cli/guard.py

@@ -1232,17 +1232,21 @@ def _detect_ai_tools() -> list[dict]:
     if codex_dir.exists():
         config = codex_dir / "config.toml"
         is_desktop = _check_toml_str(config, "[desktop]")
+        # Codex Desktop uses the same provider configuration as Codex CLI.
+        # Do not report it as partial when the Conduct provider is selected.
+        codex_proxy = _check_toml_str(config, 'model_provider = "conduct"')
+        codex_mcp = _check_toml_str(config, "mcp_servers.conduct") or _check_toml_str(config, "conduct-mcp")
         if is_desktop:
             tools.append({
                 "name": "codex-desktop",
-                "mcp_registered": _check_toml_str(config, "conduct-mcp"),
+                "mcp_registered": codex_mcp,
                 "hook_registered": _check_toml_str(config, "conductguard") or _check_toml_str(config, "conduct"),
-                "proxy_routed": False,
+                "proxy_routed": codex_proxy,
             })
         else:
             tools.append({
                 "name": "codex",
-                "mcp_registered": _check_toml_str(config, "conduct-mcp"),
+                "mcp_registered": codex_mcp,
                 "hook_registered": _check_toml_str(config, "conductguard") or _check_toml_str(config, "conduct"),
                 "proxy_routed": _is_openai_proxied(),
             })

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/src/conduct_cli/hooks/posttooluse.py

@@ -236,8 +236,16 @@ def post_codex_main() -> None:
     time.sleep(2)
     transcript_path = args.get("transcript_path", "")
     tokens_in, tokens_out = _scan_codex_tokens(transcript_path)
-    if tokens_in or tokens_out:
-        _post_usage(args.get("session_id"), args.get("tool_name"), tokens_in, tokens_out, None, args.get("blast_radius"))
+    _post_usage(
+        args.get("session_id"),
+        args.get("tool_name") or "unknown",
+        tokens_in,
+        tokens_out,
+        None,
+        args.get("blast_radius"),
+        args.get("execution_status"),
+        args.get("result_summary"),
+    )
     sys.exit(0)
 
 
@@ -280,6 +288,8 @@ def main() -> None:
                 "tool_name":       tool_name,
                 "transcript_path": transcript_path,
                 "blast_radius":    blast_radius,
+                "execution_status": execution_status,
+                "result_summary":   result_summary,
             }))
             subprocess.Popen(
                 [sys.executable, str(_this_file), "post-codex", str(pending)],
@@ -301,6 +311,20 @@ def main() -> None:
                 if action == "warn" and session_id and rule_id:
                     _record_session_warn(session_id, rule_id)
                 post_event(tool_name, {}, decision, rule_id, message, session_id, drain_via=_this_file, blast_radius=blast_radius)
+    elif session_id:
+        # Some Codex clients omit transcript_path. Still send the PostToolUse
+        # update so the pre-tool audit row is correlated and execution status
+        # is visible; token backfill can remain unavailable for this call.
+        _post_usage(
+            session_id,
+            tool_name or "unknown",
+            0,
+            0,
+            None,
+            blast_radius,
+            execution_status,
+            result_summary,
+        )
 
     sys.exit(0)
 

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/src/conduct_cli/hooks/session_start.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -18,6 +19,11 @@ from conduct_cli.hooks.base import (
 
 MAX_AGE_HOURS = 2
 
+_PROXY_TOKEN_RE = re.compile(
+    r"^\s*(?:export\s+)?ANTHROPIC_API_KEY\s*=\s*['\"]?(?:cond_agt_|guard-mt-)[A-Za-z0-9_-]+['\"]?\s*$",
+    re.MULTILINE,
+)
+
 
 def _check_proxy_token() -> None:
     """Warn + alert server if the proxy token is missing, malformed, or expired.
@@ -31,10 +37,7 @@ def _check_proxy_token() -> None:
         return
     env_text = CONDUCT_ENV_PATH.read_text()
     has_base_url    = "ANTHROPIC_BASE_URL=" in env_text
-    has_valid_token = (
-        'ANTHROPIC_API_KEY="guard-mt-' in env_text
-        or "ANTHROPIC_API_KEY='guard-mt-" in env_text
-    )
+    has_valid_token = bool(_PROXY_TOKEN_RE.search(env_text))
     if not has_base_url:
         return
 

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.14.4
+Version: 0.14.6
 Summary: Runtime governance for AI agents. CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: Apache-2.0

{conduct_cli-0.14.4 → conduct_cli-0.14.6}/src/conduct_cli.egg-info/SOURCES.txt

@@ -51,6 +51,7 @@ tests/test_pretooluse_check_policy.py
 tests/test_proxy_coverage.py
 tests/test_proxy_env.py
 tests/test_report_tool_coverage.py
+tests/test_session_start.py
 tests/test_signed_policy.py
 tests/test_switch.py
 tests/test_token_lifecycle.py

conduct_cli-0.14.6/tests/test_session_start.py

@@ -0,0 +1,40 @@
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from conduct_cli.hooks import session_start
+
+
+@pytest.mark.parametrize("token", ["cond_agt_current-token", "guard-mt-legacy-token"])
+def test_proxy_token_check_accepts_current_and_legacy_tokens(tmp_path, monkeypatch, capsys, token):
+    env_path = tmp_path / "env"
+    env_path.write_text(
+        "export ANTHROPIC_BASE_URL=\"https://api.conductai.ai/gateway/v1/anthropic\"\n"
+        f"export ANTHROPIC_API_KEY=\"{token}\"\n"
+    )
+    monkeypatch.setattr(session_start, "CONDUCT_ENV_PATH", env_path)
+    monkeypatch.setattr(
+        session_start,
+        "load_config",
+        lambda: {"token_expires_at": (datetime.now(timezone.utc) + timedelta(hours=1)).isoformat()},
+    )
+    monkeypatch.setattr(session_start, "post_event", lambda *args, **kwargs: pytest.fail("unexpected warning"))
+
+    session_start._check_proxy_token()
+
+    assert "missing or malformed" not in capsys.readouterr().out
+
+
+def test_proxy_token_check_warns_for_malformed_token(tmp_path, monkeypatch, capsys):
+    env_path = tmp_path / "env"
+    env_path.write_text(
+        "export ANTHROPIC_BASE_URL=\"https://api.conductai.ai/gateway/v1/anthropic\"\n"
+        "export ANTHROPIC_API_KEY=\"not-a-conduct-token\"\n"
+    )
+    monkeypatch.setattr(session_start, "CONDUCT_ENV_PATH", env_path)
+    monkeypatch.setattr(session_start, "load_config", lambda: {})
+    monkeypatch.setattr(session_start, "post_event", lambda *args, **kwargs: None)
+
+    session_start._check_proxy_token()
+
+    assert "proxy token missing or malformed" in capsys.readouterr().out