conduct-cli 0.6.4__tar.gz → 0.6.6__tar.gz

{conduct_cli-0.6.4 → conduct_cli-0.6.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.4
+Version: 0.6.6
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.6.4 → conduct_cli-0.6.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.6.4"
+version = "0.6.6"
 description = "CLI for Conduct AI — install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.6.4 → conduct_cli-0.6.6}/src/conduct_cli/hook_template.py

@@ -179,8 +179,29 @@ def _maybe_sync_policy():
 
         remote_version = remote.get("version", "")
         local_version = ""
+        local_policy: dict = {}
         if POLICY_PATH.exists():
-            local_version = json.loads(POLICY_PATH.read_text()).get("version", "")
+            local_policy = json.loads(POLICY_PATH.read_text())
+            local_version = local_policy.get("version", "")
+
+        # Meta-rule: block silent fail_closed → fail_open downgrade.
+        # An attacker who compromises the policy server cannot silently disable governance.
+        # Legitimate downgrade requires fail_mode_downgrade_token in the new policy,
+        # matching the token stored when fail_closed was originally set.
+        old_mode = local_policy.get("fail_mode", "fail_open")
+        new_mode = remote.get("fail_mode", "fail_open")
+        if old_mode == "fail_closed" and new_mode != "fail_closed":
+            expected = local_policy.get("fail_mode_downgrade_token")
+            provided = remote.get("fail_mode_downgrade_token")
+            if not expected or expected != provided:
+                _post_signature_invalid_event(
+                    expected_sig=f"fail_mode_downgrade_token:{expected}",
+                    computed_sig=f"fail_mode_downgrade_token:{provided}",
+                    policy_version=remote_version,
+                    hostname=__import__("platform").node(),
+                )
+                return  # reject downgrade — keep existing fail_closed policy
+
         if remote_version != local_version:
             POLICY_PATH.write_text(json.dumps(remote, indent=2))
         VERSION_CACHE_PATH.write_text(json.dumps({"ts": time.time(), "version": remote_version}))
@@ -343,8 +364,18 @@ def _detect_repo():  # -> Optional[str]
 
 def _detect_ai_tool():
     import os
-    if os.environ.get("CLAUDECODE") or os.environ.get("CLAUDE_CODE_ENTRYPOINT"):
+    # Explicit env vars — most reliable, set by the tool itself
+    if os.environ.get("CLAUDE_CODE_ENTRYPOINT") or os.environ.get("CLAUDECODE"):
         return "claude-code"
+    if os.environ.get("CODEX_SESSION_ID") or os.environ.get("CODEX_CLI_VERSION"):
+        return "codex"
+    # TERM_PROGRAM is set by Cursor, Windsurf, and similar IDE terminals
+    term = os.environ.get("TERM_PROGRAM", "").lower()
+    if term == "cursor":
+        return "cursor"
+    if term == "windsurf":
+        return "windsurf"
+    # PATH-based fallback
     path = os.environ.get("PATH", "")
     if "Codex.app" in path or "codex" in path.lower():
         return "codex"
@@ -352,7 +383,7 @@ def _detect_ai_tool():
         return "cursor"
     if "windsurf" in path.lower():
         return "windsurf"
-    return "unknown"
+    return "claude-code"  # default — Claude Code is primary
 
 
 def _already_warned_this_session(session_id: str, rule_id: str) -> bool:
@@ -730,11 +761,12 @@ def post_usage_main():
         data = json.load(sys.stdin)
     except Exception:
         sys.exit(0)
-    session_id      = data.get("session_id")
     tool_name       = (data.get("tool_name") or "").lower()
     tool_use_id     = data.get("tool_use_id")
     transcript_path = data.get("transcript_path")
-    is_codex = (tool_use_id or "").startswith("call_")
+    is_codex        = (tool_use_id or "").startswith("call_")
+    # Codex sends transcript_path but not session_id — use path as stable session key
+    session_id      = data.get("session_id") or (f"transcript:{transcript_path}" if transcript_path else None)
 
     if is_codex and transcript_path:
         # Write pending args; spawn delayed background reader so hook exits instantly

{conduct_cli-0.6.4 → conduct_cli-0.6.6}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.4
+Version: 0.6.6
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT