conduct-cli 0.6.33__tar.gz → 0.6.34__tar.gz

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.33
+Version: 0.6.34
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.6.33"
+version = "0.6.34"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/guard.py

@@ -18,8 +18,36 @@ CYAN   = "\033[36m"
 YELLOW = "\033[33m"
 
 GUARD_DIR    = Path.home() / ".conductguard"
-CONFIG_PATH  = GUARD_DIR / "config.json"
-POLICY_PATH  = GUARD_DIR / "policy.json"
+CONFIG_PATH  = GUARD_DIR / "config.json"   # legacy / fallback
+POLICY_PATH  = GUARD_DIR / "policy.json"   # legacy / fallback
+_CONDUCT_CFG = Path.home() / ".conduct" / "config.json"
+
+
+def _active_workspace_id() -> str | None:
+    """Active workspace from conduct switch — updates at runtime."""
+    try:
+        if _CONDUCT_CFG.exists():
+            return json.loads(_CONDUCT_CFG.read_text()).get("workspace")
+    except Exception:
+        pass
+    return None
+
+
+def _ws_config_path(ws_id: str) -> Path:
+    return GUARD_DIR / "workspaces" / f"{ws_id}.json"
+
+
+def _ws_policy_path(ws_id: str) -> Path:
+    return GUARD_DIR / f"policy_{ws_id}.json"
+
+
+def active_policy_path() -> Path:
+    ws_id = _active_workspace_id()
+    if ws_id:
+        p = _ws_policy_path(ws_id)
+        if p.exists():
+            return p
+    return POLICY_PATH
 
 # ── Hook templates — loaded from real .py files (no string embedding) ─────────
 
@@ -102,11 +130,8 @@ def _bash_command_words(cmd: str) -> list[str]:
 
 def _check_policy(tool_name, tool_input, tokens_before=0):
     """Return (matched_rule, action, rule_id, message) or (None, 'allow', None, None)."""
-    if not POLICY_PATH.exists():
-        return None, "allow", None, None
-    try:
-        policy = _json.loads(POLICY_PATH.read_text())
-    except Exception:
+    policy = _load_policy()
+    if not policy.get("rules"):
         return None, "allow", None, None
 
     rules      = policy.get("rules", [])
@@ -305,14 +330,27 @@ def _ensure_persona(workspace_id: str, api_key: str, base_url: str) -> str:
     return chosen
 
 
-def _load_guard_config() -> dict:
+def _load_guard_config(workspace_id: str | None = None) -> dict:
+    ws_id = workspace_id or _active_workspace_id()
+    if ws_id:
+        p = _ws_config_path(ws_id)
+        if p.exists():
+            return json.loads(p.read_text())
+    # fallback to legacy single-workspace config
     if CONFIG_PATH.exists():
         return json.loads(CONFIG_PATH.read_text())
     return {}
 
 
-def _save_guard_config(data: dict):
+def _save_guard_config(data: dict, workspace_id: str | None = None):
     GUARD_DIR.mkdir(parents=True, exist_ok=True)
+    ws_id = workspace_id or data.get("workspace_id") or _active_workspace_id()
+    if ws_id:
+        p = _ws_config_path(ws_id)
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(json.dumps(data, indent=2))
+        p.chmod(0o600)
+    # always write legacy path so old hook versions keep working
     CONFIG_PATH.write_text(json.dumps(data, indent=2))
     CONFIG_PATH.chmod(0o600)
 
@@ -572,13 +610,22 @@ def _req(method: str, url: str, body=None, token: str = None, api_key: str = Non
 
 
 
-def _save_policy(policy: dict):
+def _save_policy(policy: dict, workspace_id: str | None = None):
     GUARD_DIR.mkdir(parents=True, exist_ok=True)
+    ws_id = workspace_id or _active_workspace_id()
+    if ws_id:
+        _ws_policy_path(ws_id).write_text(json.dumps(policy, indent=2))
+    # always write legacy path for old hook versions
     POLICY_PATH.write_text(json.dumps(policy, indent=2))
 
 
-def _load_policy() -> dict:
+def _load_policy(workspace_id: str | None = None) -> dict:
     try:
+        ws_id = workspace_id or _active_workspace_id()
+        if ws_id:
+            p = _ws_policy_path(ws_id)
+            if p.exists():
+                return json.loads(p.read_text())
         return json.loads(POLICY_PATH.read_text())
     except Exception:
         return {"rules": []}
@@ -774,6 +821,26 @@ def cmd_guard_install(args):
     if signing_key_hex:
         _write_signing_key(signing_key_hex)
 
+    # Start watch daemon — auto-discovers agents every 15 min, no user action needed.
+    try:
+        import subprocess as _sp, sys as _sys
+        running, _ = _is_watch_running()
+        if not running:
+            log_file = open(_WATCH_LOG, "a")
+            proc = _sp.Popen(
+                [_sys.executable, "-c",
+                 "from conduct_cli.guard import _watch_loop; _watch_loop()"],
+                start_new_session=True,
+                stdout=log_file,
+                stderr=log_file,
+            )
+            _WATCH_PID.write_text(str(proc.pid))
+            print(f"  {GREEN}Guard watch:{RESET} background discovery daemon started (pid {proc.pid})")
+        else:
+            print(f"  {GREEN}Guard watch:{RESET} already running")
+    except Exception:
+        pass  # non-fatal
+
 
 def _write_signing_key(hex_key: str) -> None:
     """Write a hex-encoded signing key to ~/.conductguard/signing.key.
@@ -1634,13 +1701,7 @@ def cmd_guard_status(args):
             pass
 
     # Load local policy for rule count
-    rule_count = 0
-    if POLICY_PATH.exists():
-        try:
-            policy     = json.loads(POLICY_PATH.read_text())
-            rule_count = len(policy.get("rules", []))
-        except Exception:
-            pass
+    rule_count = len(_load_policy().get("rules", []))
 
     # Fetch today's spend
     spend = {}
@@ -1884,6 +1945,11 @@ def register_guard_parser(sub):
     discover_p.add_argument("--config-only", action="store_true", help="Skip process scan, config files only")
     discover_p.add_argument("--report", default=None, metavar="FILE", help="Write full JSON report to file")
 
+    # conduct guard watch
+    watch_p = guard_sub.add_parser("watch", help="Start background daemon — scans every 15 min, auto-pushes to Guard")
+    watch_p.add_argument("--stop",   action="store_true", help="Stop the running watch daemon")
+    watch_p.add_argument("--status", action="store_true", help="Show whether the watch daemon is running")
+
     # conduct guard lint [--file PATH]
     lint_p = guard_sub.add_parser("lint", help="Validate local policy — show errors and warnings")
     lint_p.add_argument("--file", default=None, metavar="FILE",
@@ -2011,6 +2077,112 @@ def _scan_processes() -> list[dict]:
     return found
 
 
+_WATCH_PID  = Path.home() / ".conductguard" / "watch.pid"
+_WATCH_LOG  = Path.home() / ".conductguard" / "watch.log"
+_WATCH_INTERVAL = 15 * 60  # seconds
+
+
+def _is_watch_running():
+    """Returns (is_running: bool, pid: int | None)."""
+    if not _WATCH_PID.exists():
+        return False, None
+    try:
+        pid = int(_WATCH_PID.read_text().strip())
+        os.kill(pid, 0)
+        return True, pid
+    except (ValueError, ProcessLookupError):
+        _WATCH_PID.unlink(missing_ok=True)
+        return False, None
+
+
+def _watch_loop():
+    """Background loop — runs discover+push every 15 min. Invoked as subprocess."""
+    import time, json as _json
+    # resolve config at each iteration so workspace switches are picked up
+    def _cfg():
+        return _load_guard_config()
+
+    while True:
+        try:
+            c       = _cfg()
+            api_url = _api_url(c)
+            token   = c.get("member_token", "")
+            api_key = c.get("api_key", "")
+            agents = []
+            for name, config_path, mcp_key in _discover_config_agents():
+                agents.append({
+                    "name": name, "framework": name, "source": "config",
+                    "location": str(config_path),
+                    "evidence": {"config_path": str(config_path), "under_guard": mcp_key},
+                    "risk_score": 20 if mcp_key else 70,
+                    "under_guard": mcp_key,
+                })
+            try:
+                process_agents = _scan_processes()
+                registered = {a["framework"] for a in agents if a["under_guard"]}
+                for a in process_agents:
+                    a["under_guard"] = a["framework"] in registered
+                agents += process_agents
+            except Exception:
+                pass
+            _req("POST", f"{api_url}/guard/discover/scan",
+                 body={"triggered_by": "watch", "agents": agents},
+                 token=token, api_key=api_key)
+        except Exception:
+            pass
+        time.sleep(_WATCH_INTERVAL)
+
+
+def cmd_guard_watch(args):
+    """Start/stop/status the background discovery daemon."""
+    import signal as _signal
+
+    if getattr(args, "status", False):
+        running, pid = _is_watch_running()
+        if running:
+            print(f"  Guard watch daemon running (pid {pid})")
+            log_tail = ""
+            if _WATCH_LOG.exists():
+                lines = _WATCH_LOG.read_text().splitlines()
+                log_tail = "\n".join(lines[-5:])
+            if log_tail:
+                print(f"  Last log:\n{log_tail}")
+        else:
+            print("  Guard watch daemon not running. Start with: conduct guard watch")
+        return
+
+    if getattr(args, "stop", False):
+        running, pid = _is_watch_running()
+        if not running:
+            print("  Guard watch daemon is not running.")
+            return
+        os.kill(pid, _signal.SIGTERM)
+        _WATCH_PID.unlink(missing_ok=True)
+        print(f"  Guard watch daemon stopped (pid {pid}).")
+        return
+
+    # Start
+    running, pid = _is_watch_running()
+    if running:
+        print(f"  Guard watch daemon already running (pid {pid}). Stop with: conduct guard watch --stop")
+        return
+
+    _WATCH_PID.parent.mkdir(parents=True, exist_ok=True)
+    log_file = open(_WATCH_LOG, "a")
+    import subprocess, sys as _sys
+    proc = subprocess.Popen(
+        [_sys.executable, "-c",
+         "from conduct_cli.guard import _watch_loop; _watch_loop()"],
+        start_new_session=True,
+        stdout=log_file,
+        stderr=log_file,
+    )
+    _WATCH_PID.write_text(str(proc.pid))
+    print(f"  Guard watch daemon started (pid {proc.pid}).")
+    print(f"  Scans every 15 min — results visible at conductai.ai/guard/discovery")
+    print(f"  Stop with: conduct guard watch --stop")
+
+
 def cmd_guard_lint(args):
     """Validate the local policy file and report errors / warnings."""
     import json as _json, re as _re
@@ -2329,6 +2501,8 @@ def dispatch_guard(args, guard_p):
         cmd_guard_install(args)
     elif guard_command == "discover":
         cmd_guard_discover(args)
+    elif guard_command == "watch":
+        cmd_guard_watch(args)
     elif guard_command == "lint":
         cmd_guard_lint(args)
     elif guard_command == "booster-status":

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/guardmcp.py

@@ -24,9 +24,28 @@ import urllib.request
 import urllib.error
 from pathlib import Path
 
-GUARD_DIR   = Path.home() / ".conductguard"
-POLICY_PATH = GUARD_DIR / "policy.json"
-CONFIG_PATH = GUARD_DIR / "config.json"
+GUARD_DIR    = Path.home() / ".conductguard"
+POLICY_PATH  = GUARD_DIR / "policy.json"
+CONFIG_PATH  = GUARD_DIR / "config.json"
+_CONDUCT_CFG = Path.home() / ".conduct" / "config.json"
+
+
+def _active_workspace_id() -> str | None:
+    try:
+        if _CONDUCT_CFG.exists():
+            return json.loads(_CONDUCT_CFG.read_text()).get("workspace")
+    except Exception:
+        pass
+    return None
+
+
+def _active_policy_path() -> Path:
+    ws_id = _active_workspace_id()
+    if ws_id:
+        p = GUARD_DIR / f"policy_{ws_id}.json"
+        if p.exists():
+            return p
+    return POLICY_PATH
 
 PROTOCOL_VERSION = "2024-11-05"
 
@@ -122,20 +141,26 @@ _TOOLS = [
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
 def _load_policy() -> dict:
-    if POLICY_PATH.exists():
+    p = _active_policy_path()
+    if p.exists():
         try:
-            return json.loads(POLICY_PATH.read_text())
+            return json.loads(p.read_text())
         except Exception:
             pass
     return {"rules": []}
 
 
 def _load_config() -> dict:
-    if CONFIG_PATH.exists():
-        try:
+    try:
+        ws_id = _active_workspace_id()
+        if ws_id:
+            p = GUARD_DIR / "workspaces" / f"{ws_id}.json"
+            if p.exists():
+                return json.loads(p.read_text())
+        if CONFIG_PATH.exists():
             return json.loads(CONFIG_PATH.read_text())
-        except Exception:
-            pass
+    except Exception:
+        pass
     return {}
 
 
@@ -160,7 +185,7 @@ def _maybe_sync() -> None:
             ws_id = cfg.get("workspace_id", "")
             if ws_id:
                 with urllib.request.urlopen(f"{_DAEMON_URL}/policy?workspace_id={ws_id}", timeout=1) as r:
-                    POLICY_PATH.write_text(r.read().decode())
+                    _active_policy_path().write_text(r.read().decode())
             return
     except Exception:
         pass  # fall through to CLI sync
@@ -337,7 +362,7 @@ def _handle_guard_sync(workspace_id: str, token: str) -> str:
         with urllib.request.urlopen(req, timeout=10) as resp:
             policy = json.loads(resp.read())
         GUARD_DIR.mkdir(parents=True, exist_ok=True)
-        POLICY_PATH.write_text(json.dumps(policy, indent=2))
+        _active_policy_path().write_text(json.dumps(policy, indent=2))
         rule_count = len(policy.get("rules", []))
         return f"Policy synced — {rule_count} rule(s) active (version: {policy.get('version', 'unknown')})."
     except urllib.error.HTTPError as e:

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/hooks/base.py

@@ -17,8 +17,9 @@ from typing import Literal, Optional
 # ── Canonical paths ───────────────────────────────────────────────────────────
 
 GUARD_DIR          = Path.home() / ".conductguard"
-CONFIG_PATH        = GUARD_DIR / "config.json"
-POLICY_PATH        = GUARD_DIR / "policy.json"
+CONFIG_PATH        = GUARD_DIR / "config.json"   # legacy / fallback
+POLICY_PATH        = GUARD_DIR / "policy.json"   # legacy / fallback
+_CONDUCT_CFG       = Path.home() / ".conduct" / "config.json"
 BUDGET_CACHE_PATH  = GUARD_DIR / "budget_cache.json"
 BUDGET_CACHE_TTL   = 300   # seconds
 VERSION_CACHE_PATH = GUARD_DIR / "version_cache.json"
@@ -42,9 +43,23 @@ class HookResult:
 
 # ── Config loading ────────────────────────────────────────────────────────────
 
+def _active_workspace_id() -> str | None:
+    try:
+        if _CONDUCT_CFG.exists():
+            return json.loads(_CONDUCT_CFG.read_text()).get("workspace")
+    except Exception:
+        pass
+    return None
+
+
 def load_config() -> dict:
-    """Return ~/.conductguard/config.json as a dict; empty dict on any error."""
+    """Load Guard config for the active workspace, falling back to legacy single config."""
     try:
+        ws_id = _active_workspace_id()
+        if ws_id:
+            p = GUARD_DIR / "workspaces" / f"{ws_id}.json"
+            if p.exists():
+                return json.loads(p.read_text())
         if CONFIG_PATH.exists():
             return json.loads(CONFIG_PATH.read_text())
     except Exception:
@@ -52,6 +67,16 @@ def load_config() -> dict:
     return {}
 
 
+def active_policy_path() -> Path:
+    """Return per-workspace policy path, or legacy fallback."""
+    ws_id = _active_workspace_id()
+    if ws_id:
+        p = GUARD_DIR / f"policy_{ws_id}.json"
+        if p.exists():
+            return p
+    return POLICY_PATH
+
+
 # ── Repo / tool detection ─────────────────────────────────────────────────────
 
 def detect_repo() -> Optional[str]:

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/hooks/pretooluse.py

@@ -18,6 +18,7 @@ from conduct_cli.hooks.base import (
     JOURNAL_DIR,
     JOURNAL_PID_PATH,
     POLICY_PATH,
+    active_policy_path,
     SIGNING_KEY_PATH,
     VERSION_CACHE_PATH,
     VERSION_CACHE_TTL,
@@ -152,18 +153,20 @@ def _post_signature_invalid_event(expected_sig, computed_sig, policy_version, ho
 def _maybe_sync_policy() -> None:
     """Sync policy from daemon (instant) or remote API (once per minute). Never raises."""
     try:
-        cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
+        cfg = load_config()
         workspace_id = cfg.get("workspace_id")
         api_key      = cfg.get("api_key", "")
         api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
         if not workspace_id:
             return
 
+        pol_path = active_policy_path()
+
         if _daemon_alive():
             url = f"{_DAEMON_URL}/policy?workspace_id={workspace_id}"
             with urllib.request.urlopen(url, timeout=1) as resp:
                 remote = json.loads(resp.read())
-            POLICY_PATH.write_text(json.dumps(remote, indent=2))
+            pol_path.write_text(json.dumps(remote, indent=2))
             return
 
         if VERSION_CACHE_PATH.exists():
@@ -188,8 +191,8 @@ def _maybe_sync_policy() -> None:
         remote_version = remote.get("version", "")
         local_version  = ""
         local_policy: dict = {}
-        if POLICY_PATH.exists():
-            local_policy  = json.loads(POLICY_PATH.read_text())
+        if pol_path.exists():
+            local_policy  = json.loads(pol_path.read_text())
             local_version = local_policy.get("version", "")
 
         old_mode = local_policy.get("fail_mode", "fail_open")
@@ -207,7 +210,7 @@ def _maybe_sync_policy() -> None:
                 return
 
         if remote_version != local_version:
-            POLICY_PATH.write_text(json.dumps(remote, indent=2))
+            pol_path.write_text(json.dumps(remote, indent=2))
         VERSION_CACHE_PATH.write_text(json.dumps({"ts": time.time(), "version": remote_version}))
     except Exception:
         pass
@@ -292,10 +295,11 @@ def _bash_operator_signature(command: str) -> str:
 
 def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
     """Return (matched_rule, action, rule_id, message) or (None, 'allow', None, None)."""
-    if not POLICY_PATH.exists():
+    pol_path = active_policy_path()
+    if not pol_path.exists():
         return None, "allow", None, None
     try:
-        policy = json.loads(POLICY_PATH.read_text())
+        policy = json.loads(pol_path.read_text())
     except Exception:
         return None, "allow", None, None
 
@@ -409,7 +413,7 @@ def main() -> None:
     _this_file = Path(__file__).resolve()
 
     # Fail-closed gate
-    if _get_fail_mode() == "fail_closed" and not POLICY_PATH.exists():
+    if _get_fail_mode() == "fail_closed" and not active_policy_path().exists():
         tool_name  = (data.get("tool_name") or "").lower()
         tool_input = data.get("tool_input") or {}
         session_id = data.get("session_id")

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/main.py

@@ -2736,19 +2736,17 @@ def cmd_test_guard(args):
     """Test each guard policy rule with a matching synthetic tool call."""
     import json as _json
     import re as _re
-    from conduct_cli.guard import CONFIG_PATH, POLICY_PATH
+    from conduct_cli.guard import _load_guard_config, _load_policy, active_policy_path
 
-    try:
-        cfg = _json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
-    except Exception:
-        cfg = {}
+    cfg = _load_guard_config()
+    pol_path = active_policy_path()  # workspace-scoped
 
-    if not POLICY_PATH.exists():
+    if not pol_path.exists():
         print(f"{RED}No policy file found. Run: conduct guard sync{RESET}")
         sys.exit(1)
 
     try:
-        policy = _json.loads(POLICY_PATH.read_text())
+        policy = _load_policy()
     except Exception as e:
         print(f"{RED}Could not load policy: {e}{RESET}")
         sys.exit(1)

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli/mcp_server.py

@@ -97,10 +97,24 @@ def _load_conduct_config() -> dict:
     return {}
 
 
+def _active_guard_policy_path() -> Path:
+    try:
+        cfg = json.loads(CONDUCT_CONFIG_PATH.read_text()) if CONDUCT_CONFIG_PATH.exists() else {}
+        ws_id = cfg.get("workspace")
+        if ws_id:
+            p = GUARD_DIR / f"policy_{ws_id}.json"
+            if p.exists():
+                return p
+    except Exception:
+        pass
+    return GUARD_POLICY_PATH
+
+
 def _load_guard_policy() -> dict:
-    if GUARD_POLICY_PATH.exists():
+    p = _active_guard_policy_path()
+    if p.exists():
         try:
-            return json.loads(GUARD_POLICY_PATH.read_text())
+            return json.loads(p.read_text())
         except Exception:
             pass
     return {"rules": []}

{conduct_cli-0.6.33 → conduct_cli-0.6.34}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.33
+Version: 0.6.34
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT