conduct-cli 0.4.58__tar.gz → 0.4.60__tar.gz

{conduct_cli-0.4.58 → conduct_cli-0.4.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.4.58
+Version: 0.4.60
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.4.58 → conduct_cli-0.4.60}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.4.58"
+version = "0.4.60"
 description = "CLI for Conduct AI — install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.4.58 → conduct_cli-0.4.60}/src/conduct_cli/guard.py

@@ -241,8 +241,75 @@ def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms)
     )
 
 
+SECRET_PATTERNS = [
+    (r"sk-[A-Za-z0-9]{20,}",          "secret-leak",    "high",     "Potential OpenAI/Anthropic API key"),
+    (r"ghp_[A-Za-z0-9]{36}",           "secret-leak",    "high",     "GitHub Personal Access Token"),
+    (r"AKIA[0-9A-Z]{16}",              "secret-leak",    "critical", "AWS Access Key ID"),
+    (r"Bearer\s+[A-Za-z0-9+/=]{20,}",  "secret-leak",    "high",     "Bearer token in output"),
+    (r"""password\s*=\s*['"][^'"]{4,}""","secret-leak",  "high",     "Hardcoded password"),
+    (r"""api[_-]?key\s*=\s*['"][^'"]{4,}""","secret-leak","high",    "Hardcoded API key"),
+    (r"\.\./\.\./\.\./",               "path-traversal", "medium",   "Path traversal sequence"),
+    (r"file://",                        "path-traversal", "medium",   "File URI scheme in output"),
+    (r"\beval\s*\(",                    "injection",      "high",     "eval() in output"),
+    (r"\bexec\s*\(",                    "injection",      "high",     "exec() in output"),
+    (r"\b__import__\s*\(",              "injection",      "high",     "__import__() in output"),
+    (r"ssl\.CERT_NONE",                 "crypto",         "high",     "SSL verification disabled"),
+    (r"verify\s*=\s*False",             "crypto",         "medium",   "TLS verification bypassed"),
+]
+OWASP_KEYWORDS = [
+    ("sql injection",    "injection",   "high",   "SQL injection mentioned in AI output"),
+    ("cross-site scripting","injection","high",   "XSS mentioned in AI output"),
+    (" xss ",            "injection",   "high",   "XSS mentioned in AI output"),
+    ("idor",             "injection",   "medium", "IDOR mentioned in AI output"),
+    ("ssrf",             "injection",   "high",   "SSRF mentioned in AI output"),
+    ("command injection","injection",   "high",   "Command injection mentioned in AI output"),
+    ("auth bypass",      "auth-bypass", "high",   "Auth bypass mentioned in AI output"),
+]
+
+
+def _classify_text(text):
+    """Return (finding_type, severity, description, matched_pattern) or (None,...) if clean."""
+    import re as _re
+    for pattern, ftype, sev, desc in SECRET_PATTERNS:
+        if _re.search(pattern, text, _re.IGNORECASE):
+            return ftype, sev, desc, pattern
+    lower = text.lower()
+    for kw, ftype, sev, desc in OWASP_KEYWORDS:
+        if kw in lower:
+            return ftype, sev, desc, kw
+    return None, None, None, None
+
+
+def _line_number_from_text(text, matched_pattern):
+    """Extract line number where pattern matched.
+    Uses splitlines() and chr(10) — no backslash-n literals (safe inside _HOOK_SCRIPT).
+    """
+    import re as _re
+    if not matched_pattern:
+        return None
+    try:
+        # Try cat-n format first (Read tool outputs '   N<TAB>code line')
+        for raw_line in text.splitlines():
+            m = _re.match(r"^\s*(\d+)\t(.*)$", raw_line)
+            if m:
+                lineno, content = int(m.group(1)), m.group(2)
+                try:
+                    if _re.search(matched_pattern, content, _re.IGNORECASE):
+                        return lineno
+                except Exception:
+                    if matched_pattern.lower() in content.lower():
+                        return lineno
+        # Fallback: count lines before the first match offset
+        m = _re.search(matched_pattern, text, _re.IGNORECASE)
+        if m:
+            return text[:m.start()].count(chr(10)) + 1
+    except Exception:
+        pass
+    return None
+
+
 def _maybe_emit_security_finding(tool_response, session_id, tool_name, tool_input=None):
-    """Classify tool_response for security findings; POST to /security-findings if flag ON. Never raises."""
+    """Classify tool output + input for security findings; POST if flag ON. Never raises."""
     try:
         cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
     except Exception:
@@ -255,55 +322,37 @@ def _maybe_emit_security_finding(tool_response, session_id, tool_name, tool_inpu
     if not workspace_id:
         return
 
-    import re as _re2
-    text = str(tool_response)
-
-    # Fast-path classifier
-    SECRET_PATTERNS = [
-        (r"sk-[A-Za-z0-9]{20,}", "secret-leak", "high", "Potential OpenAI/Anthropic API key"),
-        (r"ghp_[A-Za-z0-9]{36}", "secret-leak", "high", "GitHub Personal Access Token"),
-        (r"AKIA[0-9A-Z]{16}", "secret-leak", "critical", "AWS Access Key ID"),
-        (r"Bearer\s+[A-Za-z0-9+/=]{20,}", "secret-leak", "high", "Bearer token in output"),
-        (r"""password\s*=\s*['"][^'"]{4,}""", "secret-leak", "high", "Hardcoded password"),
-        (r"""api[_-]?key\s*=\s*['"][^'"]{4,}""", "secret-leak", "high", "Hardcoded API key"),
-        (r"\.\./\.\./\.\./", "path-traversal", "medium", "Path traversal sequence"),
-        (r"file://", "path-traversal", "medium", "File URI scheme in output"),
-        (r"\beval\s*\(", "injection", "high", "eval() in output"),
-        (r"\bexec\s*\(", "injection", "high", "exec() in output"),
-        (r"\b__import__\s*\(", "injection", "high", "__import__() in output"),
-        (r"ssl\.CERT_NONE", "crypto", "high", "SSL verification disabled"),
-        (r"verify\s*=\s*False", "crypto", "medium", "TLS verification bypassed"),
-    ]
-    OWASP_KEYWORDS = [
-        ("sql injection", "injection", "high", "SQL injection mentioned in AI output"),
-        ("cross-site scripting", "injection", "high", "XSS mentioned in AI output"),
-        (" xss ", "injection", "high", "XSS mentioned in AI output"),
-        ("idor", "injection", "medium", "IDOR mentioned in AI output"),
-        ("ssrf", "injection", "high", "SSRF mentioned in AI output"),
-        ("command injection", "injection", "high", "Command injection mentioned in AI output"),
-        ("auth bypass", "auth-bypass", "high", "Auth bypass mentioned in AI output"),
-    ]
+    ti = tool_input or {}
 
-    finding_type = severity = description = None
-    for pattern, ftype, sev, desc in SECRET_PATTERNS:
-        if _re2.search(pattern, text, _re2.IGNORECASE):
-            finding_type, severity, description = ftype, sev, desc
+    # Build scan candidates: (text_to_scan, source_label)
+    # Priority: tool_response first (Read), then written content (Edit/Write), then command (Bash)
+    candidates = [("response", str(tool_response))]
+    if tool_name in ("edit", "multiedit"):
+        candidates.append(("input", ti.get("new_string", "")))
+    elif tool_name == "write":
+        candidates.append(("input", ti.get("content", "")))
+    elif tool_name in ("bash", "terminal"):
+        candidates.append(("input", ti.get("command", "")))
+
+    finding_type = severity = description = matched_pattern = scan_text = None
+    for _src, text in candidates:
+        ft, sv, desc, pat = _classify_text(text)
+        if ft:
+            finding_type, severity, description, matched_pattern, scan_text = ft, sv, desc, pat, text
             break
-    if not finding_type:
-        lower = text.lower()
-        for kw, ftype, sev, desc in OWASP_KEYWORDS:
-            if kw in lower:
-                finding_type, severity, description = ftype, sev, desc
-                break
+
     if not finding_type:
         return
 
-    ti = tool_input or {}
+    # File path
     file_path = (
         ti.get("file_path") or ti.get("path") or
         (ti.get("command", "")[:120] if tool_name in ("bash", "terminal") else None)
     ) or None
 
+    # Line number
+    line_no = _line_number_from_text(scan_text, matched_pattern) if scan_text else None
+
     payload = json.dumps({
         "tool": _detect_ai_tool(),
         "severity": severity,
@@ -312,6 +361,7 @@ def _maybe_emit_security_finding(tool_response, session_id, tool_name, tool_inpu
         "source_run_id": session_id,
         "reporter_email": cfg.get("user_email") or "",
         "file": file_path,
+        "line": line_no,
     })
     script = (
         "import urllib.request\\n"
@@ -760,17 +810,25 @@ def _best_python() -> str:
 
 def _write_hook(path: Path) -> None:
     """Write _HOOK_SCRIPT to path, then py_compile-validate it.
-    Raises RuntimeError if the written file fails to compile — prevents
-    silently deploying a syntactically broken hook."""
+    On syntax failure: restores previous hook (or writes a safe stub) so the
+    system is never left without a working hook file."""
     import py_compile, tempfile, os
+    # Stash existing hook so we can restore on failure
+    backup = None
+    if path.exists():
+        backup = path.read_text()
+    path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(_HOOK_SCRIPT)
     path.chmod(0o755)
     try:
         py_compile.compile(str(path), doraise=True)
     except py_compile.PyCompileError as exc:
-        path.unlink(missing_ok=True)
+        if backup is not None:
+            path.write_text(backup)
+        else:
+            path.write_text("#!/usr/bin/env python3\nimport sys\nsys.exit(0)\n")
         raise RuntimeError(
-            f"hook.py failed syntax check after write — hook NOT installed.\n{exc}"
+            f"hook.py failed syntax check — previous hook restored.\n{exc}"
         ) from exc
 
 

{conduct_cli-0.4.58 → conduct_cli-0.4.60}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.4.58
+Version: 0.4.60
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT