conduct-cli 0.5.6__tar.gz → 0.5.8__tar.gz

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.5.6
+Version: 0.5.8
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.5.6"
+version = "0.5.8"
 description = "CLI for Conduct AI — install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/src/conduct_cli/guard.py

@@ -572,8 +572,13 @@ def cmd_guard_install(args):
             api_key=api_key,
         )
         _save_policy(policy)
+        # Mirror fail_mode into guard config so the hook can enforce it
+        # even when POLICY_PATH is missing or unreadable.
+        cfg = _load_guard_config()
+        cfg["fail_mode"] = policy.get("fail_mode", "fail_open")
+        _save_guard_config(cfg)
         rule_count = len(policy.get("rules", []))
-        print(f"  {GREEN}Guard policies:{RESET} {rule_count} rule(s) active")
+        print(f"  {GREEN}Guard policies:{RESET} {rule_count} rule(s) active · fail mode: {cfg['fail_mode']}")
     except SystemExit:
         rule_count = 0
 

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/src/conduct_cli/hook_template.py

@@ -86,7 +86,17 @@ def _maybe_sync_policy():
             POLICY_PATH.write_text(json.dumps(remote, indent=2))
         VERSION_CACHE_PATH.write_text(json.dumps({"ts": time.time(), "version": remote_version}))
     except Exception:
-        pass  # Never block a tool call due to sync failure
+        pass  # sync failure does not directly block; policy file may still be present
+
+
+def _get_fail_mode():
+    """Read fail_mode from ~/.conduct/config.json. Default: fail_open."""
+    try:
+        cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
+    except Exception:
+        return "fail_open"
+    mode = cfg.get("fail_mode", "fail_open")
+    return mode if mode in ("fail_open", "fail_closed") else "fail_open"
 
 
 def _load_budget_cache():
@@ -685,10 +695,35 @@ def main():
     # Policy version check (cached 60s) — auto-syncs if server version differs
     _maybe_sync_policy()
 
+    # Fail-closed gate: if the local policy file is missing and the workspace
+    # is configured for fail_closed, block every tool call with a clear
+    # message. fail_open (default) silently allows.
+    if _get_fail_mode() == "fail_closed" and not POLICY_PATH.exists():
+        tool_name  = (data.get("tool_name") or "").lower()
+        tool_input = data.get("tool_input") or {}
+        session_id = data.get("session_id")
+        msg = "[ConductGuard] Policy cache unavailable — fail-closed mode is on. Run `conduct guard sync` or contact your admin."
+        print(msg)
+        print(msg, file=sys.stderr)
+        _post_event(tool_name, tool_input, "blocked", "guard-unavailable", msg, session_id=session_id)
+        sys.exit(2)
+
     # Hard budget cap (cached 5 min)
     hard_blocked, reason = _load_budget_cache()
     if hard_blocked is None:
         hard_blocked, reason = _fetch_budget_status()
+        # Fail-closed: if the budget check returned default (None reason) AND
+        # we just hit the API for a fresh value, the API was unreachable.
+        # Treat as unavailable and block.
+        if not hard_blocked and reason is None and _get_fail_mode() == "fail_closed":
+            tool_name  = (data.get("tool_name") or "").lower()
+            tool_input = data.get("tool_input") or {}
+            session_id = data.get("session_id")
+            msg = "[ConductGuard] Spend budget check unavailable — fail-closed mode is on."
+            print(msg)
+            print(msg, file=sys.stderr)
+            _post_event(tool_name, tool_input, "blocked", "guard-unavailable", msg, session_id=session_id)
+            sys.exit(2)
     if hard_blocked:
         msg = f"[ConductGuard] {reason or 'Budget hard cap reached. Contact your manager.'}"
         print(msg)

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/src/conduct_cli/main.py

@@ -2431,6 +2431,22 @@ def cmd_run(args):
             hint = "export GITHUB_TOKEN=<token>" if not gh_token else "workflow has no github_hook_repo"
             print(f"  {GRAY}No GitHub token — using test payload. ({hint}){RESET}\n")
 
+    # #734: validate required inputs locally before POST — fail fast with clear error.
+    try:
+        vres = api.req("POST", f"{server}/workflows/{workflow_id}/validate-inputs", json_h,
+                       {"inputs": body.get("inputs") or {}, "phase": "run"})
+        missing = (vres or {}).get("missing") or []
+        if missing:
+            print(f"{RED}✗ Missing required inputs:{RESET}")
+            for m in missing:
+                print(f"  - {m['label']} ({m['key']})")
+            print(f"\n{GRAY}Provide with --input {missing[0]['key']}=<value>{RESET}")
+            sys.exit(2)
+    except SystemExit:
+        raise
+    except Exception:
+        pass  # validate endpoint is best-effort; backend will re-check on /trigger
+
     # Fix 3: /trigger returns run_id, not id.
     if getattr(args, "max_turns", None):
         body["__max_turns"] = args.max_turns

{conduct_cli-0.5.6 → conduct_cli-0.5.8}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.5.6
+Version: 0.5.8
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT