conduct-cli 0.6.5__tar.gz → 0.6.6__tar.gz

{conduct_cli-0.6.5 → conduct_cli-0.6.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.5
+Version: 0.6.6
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.6.5 → conduct_cli-0.6.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.6.5"
+version = "0.6.6"
 description = "CLI for Conduct AI — install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.6.5 → conduct_cli-0.6.6}/src/conduct_cli/hook_template.py

@@ -179,8 +179,29 @@ def _maybe_sync_policy():
 
         remote_version = remote.get("version", "")
         local_version = ""
+        local_policy: dict = {}
         if POLICY_PATH.exists():
-            local_version = json.loads(POLICY_PATH.read_text()).get("version", "")
+            local_policy = json.loads(POLICY_PATH.read_text())
+            local_version = local_policy.get("version", "")
+
+        # Meta-rule: block silent fail_closed → fail_open downgrade.
+        # An attacker who compromises the policy server cannot silently disable governance.
+        # Legitimate downgrade requires fail_mode_downgrade_token in the new policy,
+        # matching the token stored when fail_closed was originally set.
+        old_mode = local_policy.get("fail_mode", "fail_open")
+        new_mode = remote.get("fail_mode", "fail_open")
+        if old_mode == "fail_closed" and new_mode != "fail_closed":
+            expected = local_policy.get("fail_mode_downgrade_token")
+            provided = remote.get("fail_mode_downgrade_token")
+            if not expected or expected != provided:
+                _post_signature_invalid_event(
+                    expected_sig=f"fail_mode_downgrade_token:{expected}",
+                    computed_sig=f"fail_mode_downgrade_token:{provided}",
+                    policy_version=remote_version,
+                    hostname=__import__("platform").node(),
+                )
+                return  # reject downgrade — keep existing fail_closed policy
+
         if remote_version != local_version:
             POLICY_PATH.write_text(json.dumps(remote, indent=2))
         VERSION_CACHE_PATH.write_text(json.dumps({"ts": time.time(), "version": remote_version}))

{conduct_cli-0.6.5 → conduct_cli-0.6.6}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.5
+Version: 0.6.6
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT