conduct-cli 0.6.6__tar.gz → 0.6.9__tar.gz

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.6
+Version: 0.6.9
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -25,6 +25,7 @@ Requires-Dist: rich>=13.0
 Provides-Extra: booster
 Requires-Dist: agent-booster[watch]>=0.2.23; extra == "booster"
 
+<!-- mcp-name: io.github.sseshachala/conduct-cli -->
 # conduct-cli
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
@@ -261,6 +262,29 @@ conduct guard sync
 
 ---
 
+## Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "conduct": {
+      "command": "conduct-mcp",
+      "args": []
+    },
+    "conductguard": {
+      "command": "conductguard-mcp",
+      "args": ["--team", "<workspace-id>", "--token", "<member-token>"]
+    }
+  }
+}
+```
+
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+
+---
+
 ## Links
 
 - Dashboard: [conductai.ai](https://conductai.ai)

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/README.md

@@ -1,3 +1,4 @@
+<!-- mcp-name: io.github.sseshachala/conduct-cli -->
 # conduct-cli
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
@@ -234,6 +235,29 @@ conduct guard sync
 
 ---
 
+## Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "conduct": {
+      "command": "conduct-mcp",
+      "args": []
+    },
+    "conductguard": {
+      "command": "conductguard-mcp",
+      "args": ["--team", "<workspace-id>", "--token", "<member-token>"]
+    }
+  }
+}
+```
+
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+
+---
+
 ## Links
 
 - Dashboard: [conductai.ai](https://conductai.ai)

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.6.6"
+version = "0.6.9"
 description = "CLI for Conduct AI — install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/src/conduct_cli/guard.py

@@ -1221,11 +1221,23 @@ def _write_proxy_env(member_token: str, proxy_url: str) -> tuple[Path, bool]:
         return Path(), False
 
     existing = rc.read_text() if rc.exists() else ""
+    CLAUDE_ALIAS = "alias claude='env -u ANTHROPIC_BASE_URL claude'"
+
     if SHELL_RC_MARKER in existing:
+        # Already installed — patch in the alias if missing (upgrade path)
+        if CLAUDE_ALIAS not in existing:
+            rc.write_text(existing.rstrip() + f"\n{CLAUDE_ALIAS}\n")
+            return rc, True
         return rc, False
 
     rc.parent.mkdir(parents=True, exist_ok=True)
-    addition = f"\n\n{SHELL_RC_MARKER}\n{SHELL_SOURCE_LINE}\n"
+    # ponytail: alias strips ANTHROPIC_BASE_URL so Claude Code auth isn't routed
+    # through the Guard proxy (Claude Code governs agents; it isn't one)
+    addition = (
+        f"\n\n{SHELL_RC_MARKER}\n"
+        f"{SHELL_SOURCE_LINE}\n"
+        f"{CLAUDE_ALIAS}\n"
+    )
     rc.write_text(existing.rstrip() + addition if existing else addition.lstrip())
     return rc, True
 

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/src/conduct_cli/hook_template.py

@@ -39,6 +39,8 @@ VERSION_CACHE_PATH  = GUARD_DIR / "version_cache.json"
 VERSION_CACHE_TTL   = 60   # 1 minute — matches server poll window
 WARNED_RULES_PATH   = GUARD_DIR / "warned_rules.json"
 SIGNING_KEY_PATH    = GUARD_DIR / "signing.key"
+JOURNAL_DIR         = GUARD_DIR / "journal"
+JOURNAL_PID_PATH    = JOURNAL_DIR / "drain.pid"
 
 
 _DAEMON_URL = "http://127.0.0.1:7878"
@@ -415,6 +417,87 @@ def _record_session_warn(session_id: str, rule_id: str) -> None:
         pass
 
 
+def _journal_append(payload_str, api_url):
+    """Atomically write one event to the journal for the drain daemon to pick up."""
+    try:
+        JOURNAL_DIR.mkdir(parents=True, exist_ok=True)
+        import time, random
+        name = f"{time.time_ns()}_{random.randint(0, 9999):04d}.json"
+        entry = json.dumps({"api_url": api_url, "payload": payload_str})
+        tmp = JOURNAL_DIR / (name + ".tmp")
+        tmp.write_text(entry)
+        tmp.rename(JOURNAL_DIR / name)
+    except Exception:
+        pass
+
+
+def _ensure_drain_daemon():
+    """Start the drain daemon if it isn't already running."""
+    try:
+        if JOURNAL_PID_PATH.exists():
+            pid = int(JOURNAL_PID_PATH.read_text().strip())
+            import os as _os
+            try:
+                _os.kill(pid, 0)
+                return  # alive
+            except (ProcessLookupError, PermissionError):
+                pass
+        hook_path = Path(__file__).resolve()
+        subprocess.Popen(
+            [sys.executable, str(hook_path), "drain"],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+    except Exception:
+        pass
+
+
+def _run_drain_daemon():
+    """Drain journal → API. Called as: python hook.py drain"""
+    import os as _os, time as _time
+    try:
+        JOURNAL_DIR.mkdir(parents=True, exist_ok=True)
+        JOURNAL_PID_PATH.write_text(str(_os.getpid()))
+    except Exception:
+        return
+    empty_scans = 0
+    while empty_scans < 3:
+        files = sorted(f for f in JOURNAL_DIR.glob("*.json") if f.name != "drain.pid")
+        if not files:
+            empty_scans += 1
+            _time.sleep(2)
+            continue
+        posted_any = False
+        for f in files:
+            try:
+                entry = json.loads(f.read_text())
+                api_url = entry["api_url"]
+                payload = entry["payload"].encode() if isinstance(entry["payload"], str) else entry["payload"]
+                import urllib.request as _ur
+                req = _ur.Request(
+                    f"{api_url}/guard/events",
+                    data=payload,
+                    headers={"Content-Type": "application/json"},
+                    method="POST",
+                )
+                _ur.urlopen(req, timeout=8)
+                f.unlink(missing_ok=True)
+                posted_any = True
+            except Exception:
+                pass  # ponytail: leave file on failure, next scan retries
+        # If every POST failed this scan, count it — prevents infinite loop on dead API
+        if not posted_any:
+            empty_scans += 1
+            _time.sleep(2)
+        else:
+            empty_scans = 0
+    try:
+        JOURNAL_PID_PATH.unlink(missing_ok=True)
+    except Exception:
+        pass
+
+
 def _post_event(tool_name, tool_input, decision, rule_id=None, message=None, session_id=None):
     try:
         cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
@@ -441,20 +524,8 @@ def _post_event(tool_name, tool_input, decision, rule_id=None, message=None, ses
         "hostname":      _platform.node(),
     })
     api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
-    script = (
-        "import urllib.request\n"
-        "try:\n"
-        f"    req = urllib.request.Request(\"{api_url}/guard/events\","
-        f" data={repr(payload.encode())}, headers={{\"Content-Type\": \"application/json\"}}, method=\"POST\")\n"
-        "    urllib.request.urlopen(req, timeout=5)\n"
-        "except: pass\n"
-    )
-    subprocess.Popen(
-        [sys.executable, "-c", script],
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
-        start_new_session=True,
-    )
+    _journal_append(payload, api_url)
+    _ensure_drain_daemon()
 
 
 def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms):
@@ -906,5 +977,7 @@ if __name__ == "__main__":
         post_usage_main()
     elif len(sys.argv) > 1 and sys.argv[1] == "post-codex":
         post_codex_main()
+    elif len(sys.argv) > 1 and sys.argv[1] == "drain":
+        _run_drain_daemon()
     else:
         main()

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.6.6
+Version: 0.6.9
 Summary: CLI for Conduct AI — install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -25,6 +25,7 @@ Requires-Dist: rich>=13.0
 Provides-Extra: booster
 Requires-Dist: agent-booster[watch]>=0.2.23; extra == "booster"
 
+<!-- mcp-name: io.github.sseshachala/conduct-cli -->
 # conduct-cli
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
@@ -261,6 +262,29 @@ conduct guard sync
 
 ---
 
+## Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "conduct": {
+      "command": "conduct-mcp",
+      "args": []
+    },
+    "conductguard": {
+      "command": "conductguard-mcp",
+      "args": ["--team", "<workspace-id>", "--token", "<member-token>"]
+    }
+  }
+}
+```
+
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+
+---
+
 ## Links
 
 - Dashboard: [conductai.ai](https://conductai.ai)

{conduct_cli-0.6.6 → conduct_cli-0.6.9}/src/conduct_cli.egg-info/SOURCES.txt

@@ -25,6 +25,8 @@ tests/test_command_word_matcher.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py
 tests/test_hook_syntax.py
+tests/test_journal_drain.py
 tests/test_log_util.py
 tests/test_proxy_env.py
+tests/test_signed_policy.py
 tests/test_switch.py

conduct_cli-0.6.9/tests/test_journal_drain.py

@@ -0,0 +1,153 @@
+"""Tests for #855-B: journal append + drain daemon logic."""
+from __future__ import annotations
+import json
+import os
+import sys
+import time
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+import pytest
+
+import conduct_cli.hook_template as ht
+
+
+# ── helpers ──────────────────────────────────────────────────────────────────
+
+def _patch_journal(tmp_path: Path):
+    """Return context managers that redirect JOURNAL_DIR/PID_PATH to tmp_path."""
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    return (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+    )
+
+
+# ── _journal_append ───────────────────────────────────────────────────────────
+
+def test_journal_append_creates_file(tmp_path):
+    p1, p2 = _patch_journal(tmp_path)
+    with p1, p2:
+        ht._journal_append('{"foo": 1}', "https://api.test")
+        journal_dir = tmp_path / "journal"
+        files = list(journal_dir.glob("*.json"))
+        assert len(files) == 1
+        entry = json.loads(files[0].read_text())
+        assert entry["payload"] == '{"foo": 1}'
+        assert entry["api_url"] == "https://api.test"
+
+
+def test_journal_append_no_tmp_files_left(tmp_path):
+    p1, p2 = _patch_journal(tmp_path)
+    with p1, p2:
+        ht._journal_append("{}", "https://api.test")
+        journal_dir = tmp_path / "journal"
+        assert not list(journal_dir.glob("*.tmp"))
+
+
+# ── _run_drain_daemon ─────────────────────────────────────────────────────────
+
+def _write_journal_entry(journal_dir: Path, payload: str, api_url: str) -> Path:
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    name = f"{time.time_ns()}_0000.json"
+    f = journal_dir / name
+    f.write_text(json.dumps({"api_url": api_url, "payload": payload}))
+    return f
+
+
+def test_drain_posts_and_deletes_on_success(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    entry = _write_journal_entry(journal_dir, '{"x":1}', "https://api.test")
+
+    mock_resp = MagicMock()
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("urllib.request.urlopen", return_value=mock_resp),
+        patch("time.sleep"),  # skip sleeps
+    ):
+        ht._run_drain_daemon()
+
+    assert not entry.exists(), "file should be deleted after successful POST"
+
+
+def test_drain_leaves_file_on_network_failure(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    entry = _write_journal_entry(journal_dir, '{"x":1}', "https://api.test")
+
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("urllib.request.urlopen", side_effect=OSError("network down")),
+        patch("time.sleep"),  # skip sleeps so daemon exits after 3 all-fail scans
+    ):
+        ht._run_drain_daemon()
+
+    assert entry.exists(), "file should survive a failed POST"
+
+
+def test_drain_exits_after_three_empty_scans(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    sleep_calls = []
+
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("time.sleep", side_effect=lambda s: sleep_calls.append(s)),
+    ):
+        ht._run_drain_daemon()
+
+    assert len(sleep_calls) == 3, "should sleep exactly 3 times before exiting"
+
+
+# ── _ensure_drain_daemon ──────────────────────────────────────────────────────
+
+def test_ensure_drain_skips_spawn_when_alive(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    pid_path.write_text(str(os.getpid()))  # our own PID — definitely alive
+
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("subprocess.Popen") as mock_popen,
+    ):
+        ht._ensure_drain_daemon()
+        mock_popen.assert_not_called()
+
+
+def test_ensure_drain_spawns_when_pid_missing(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    # no pid file written
+
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("subprocess.Popen") as mock_popen,
+    ):
+        ht._ensure_drain_daemon()
+        mock_popen.assert_called_once()
+        args = mock_popen.call_args[0][0]
+        assert args[-1] == "drain"
+
+
+def test_ensure_drain_spawns_when_pid_stale(tmp_path):
+    journal_dir = tmp_path / "journal"
+    pid_path = journal_dir / "drain.pid"
+    journal_dir.mkdir(parents=True, exist_ok=True)
+    pid_path.write_text("99999999")  # almost certainly dead
+
+    with (
+        patch.object(ht, "JOURNAL_DIR", journal_dir),
+        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch("subprocess.Popen") as mock_popen,
+    ):
+        ht._ensure_drain_daemon()
+        mock_popen.assert_called_once()

conduct_cli-0.6.9/tests/test_signed_policy.py

@@ -0,0 +1,248 @@
+"""Tests for #855-A (signed policy) and #855-C (fail-mode meta-rule)."""
+from __future__ import annotations
+import hashlib
+import hmac
+import json
+import time
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+import conduct_cli.hook_template as ht
+
+
+# ── helpers ───────────────────────────────────────────────────────────────────
+
+def _make_key() -> tuple[bytes, str]:
+    """Return (key_bytes, hex_string) for a fresh signing key."""
+    key = b"deadbeef" * 4  # 32 bytes
+    return key, key.hex()
+
+
+def _sign_policy(policy: dict, key_bytes: bytes) -> str:
+    body = {k: v for k, v in policy.items() if k not in ("signature", "signed_at")}
+    canonical = json.dumps(body, sort_keys=True, separators=(",", ":"))
+    return hmac.new(key_bytes, canonical.encode(), hashlib.sha256).hexdigest()
+
+
+def _write_key(tmp_path: Path, key_hex: str) -> Path:
+    p = tmp_path / "signing.key"
+    p.write_text(key_hex)
+    return p
+
+
+# ── #855-A: _verify_policy_signature ─────────────────────────────────────────
+
+def test_verify_passes_with_valid_signature(tmp_path):
+    key_bytes, key_hex = _make_key()
+    key_path = _write_key(tmp_path, key_hex)
+    policy = {"version": "v1", "rules": []}
+    policy["signature"] = _sign_policy(policy, key_bytes)
+
+    with (
+        patch.object(ht, "SIGNING_KEY_PATH", key_path),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+    ):
+        assert ht._verify_policy_signature(policy) is True
+
+
+def test_verify_fails_with_wrong_signature(tmp_path):
+    _, key_hex = _make_key()
+    key_path = _write_key(tmp_path, key_hex)
+    policy = {"version": "v1", "rules": [], "signature": "badbadbadbad"}
+
+    with (
+        patch.object(ht, "SIGNING_KEY_PATH", key_path),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+    ):
+        assert ht._verify_policy_signature(policy) is False
+
+
+def test_verify_fails_when_signature_missing_and_key_present(tmp_path):
+    _, key_hex = _make_key()
+    key_path = _write_key(tmp_path, key_hex)
+    policy = {"version": "v1", "rules": []}  # no "signature" key
+
+    with (
+        patch.object(ht, "SIGNING_KEY_PATH", key_path),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+    ):
+        assert ht._verify_policy_signature(policy) is False
+
+
+def test_verify_passes_when_no_key_file(tmp_path):
+    """No signing.key → dev mode, always allow."""
+    key_path = tmp_path / "signing.key"  # does not exist
+    policy = {"version": "v1", "rules": [], "signature": "anything"}
+
+    with (
+        patch.object(ht, "SIGNING_KEY_PATH", key_path),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+    ):
+        assert ht._verify_policy_signature(policy) is True
+
+
+def test_verify_strips_signature_and_signed_at_before_computing(tmp_path):
+    """signed_at and signature fields must not be part of the signed body."""
+    key_bytes, key_hex = _make_key()
+    key_path = _write_key(tmp_path, key_hex)
+    policy = {"version": "v1", "rules": [], "signed_at": "2026-01-01T00:00:00Z"}
+    policy["signature"] = _sign_policy(policy, key_bytes)
+    # Add a different signed_at — should still verify because it's excluded from body
+    policy["signed_at"] = "2030-12-31T00:00:00Z"
+
+    with (
+        patch.object(ht, "SIGNING_KEY_PATH", key_path),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+    ):
+        assert ht._verify_policy_signature(policy) is True
+
+
+# ── #855-C: fail-mode meta-rule in _maybe_sync_policy ────────────────────────
+
+def _setup_sync(tmp_path, local_policy, remote_policy, key_hex=None):
+    """
+    Wire up _maybe_sync_policy with mocked HTTP + config + paths.
+    Returns the path objects so callers can assert on POLICY_PATH.
+    """
+    config_path = tmp_path / "config.json"
+    policy_path = tmp_path / "policy.json"
+    version_cache = tmp_path / "version_cache.json"
+
+    config_path.write_text(json.dumps({
+        "workspace_id": "ws-1",
+        "api_key": "tok",
+        "api_url": "https://api.test",
+    }))
+    if local_policy is not None:
+        policy_path.write_text(json.dumps(local_policy))
+
+    # Mock urllib so "remote" is returned without a real HTTP call
+    mock_resp = MagicMock()
+    mock_resp.read.return_value = json.dumps(remote_policy).encode()
+    mock_resp.__enter__ = lambda s: s
+    mock_resp.__exit__ = MagicMock(return_value=False)
+
+    patches = [
+        patch.object(ht, "CONFIG_PATH", config_path),
+        patch.object(ht, "POLICY_PATH", policy_path),
+        patch.object(ht, "VERSION_CACHE_PATH", version_cache),
+        patch.object(ht, "SIGNING_KEY_PATH", tmp_path / "signing.key"),
+        patch.object(ht, "GUARD_DIR", tmp_path),
+        patch("urllib.request.urlopen", return_value=mock_resp),
+        patch.object(ht, "_daemon_alive", return_value=False),
+        # Disable journal side-effect from _post_signature_invalid_event
+        patch("subprocess.Popen"),
+    ]
+    if key_hex:
+        (tmp_path / "signing.key").write_text(key_hex)
+
+    return policy_path, patches
+
+
+def test_sync_rejects_tampered_policy(tmp_path):
+    """Tampered remote policy (bad sig) must not overwrite local policy."""
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    remote = {"version": "v2", "rules": [], "signature": "badhash"}
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["version"] == "v1", "tampered remote should not replace local policy"
+
+
+def test_sync_accepts_valid_signed_policy(tmp_path):
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    remote = {"version": "v2", "rules": [], "fail_mode": "fail_open"}
+    remote["signature"] = _sign_policy(remote, key_bytes)
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["version"] == "v2"
+
+
+def test_failmode_downgrade_blocked_without_token(tmp_path):
+    """fail_closed → fail_open must be rejected if no downgrade token matches."""
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+             "fail_mode_downgrade_token": "secret-abc"}
+    remote = {"version": "v2", "rules": [], "fail_mode": "fail_open"}
+    remote["signature"] = _sign_policy(remote, key_bytes)
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["fail_mode"] == "fail_closed", "downgrade without token must be rejected"
+    assert saved["version"] == "v1"
+
+
+def test_failmode_downgrade_blocked_with_wrong_token(tmp_path):
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+             "fail_mode_downgrade_token": "secret-abc"}
+    remote = {"version": "v2", "rules": [], "fail_mode": "fail_open",
+              "fail_mode_downgrade_token": "wrong-token"}
+    remote["signature"] = _sign_policy(remote, key_bytes)
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["fail_mode"] == "fail_closed"
+    assert saved["version"] == "v1"
+
+
+def test_failmode_downgrade_allowed_with_correct_token(tmp_path):
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+             "fail_mode_downgrade_token": "secret-abc"}
+    remote = {"version": "v2", "rules": [], "fail_mode": "fail_open",
+              "fail_mode_downgrade_token": "secret-abc"}
+    remote["signature"] = _sign_policy(remote, key_bytes)
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["fail_mode"] == "fail_open"
+    assert saved["version"] == "v2"
+
+
+def test_failmode_open_to_closed_always_allowed(tmp_path):
+    """Upgrading to fail_closed needs no token — only downgrade is gated."""
+    key_bytes, key_hex = _make_key()
+    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    remote = {"version": "v2", "rules": [], "fail_mode": "fail_closed"}
+    remote["signature"] = _sign_policy(remote, key_bytes)
+
+    policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
+    with _ctx(*patches):
+        ht._maybe_sync_policy()
+
+    saved = json.loads(policy_path.read_text())
+    assert saved["fail_mode"] == "fail_closed"
+    assert saved["version"] == "v2"
+
+
+# ── tiny helper so we can unpack a list of context managers ──────────────────
+
+from contextlib import contextmanager, ExitStack
+
+@contextmanager
+def _ctx(*cms):
+    with ExitStack() as stack:
+        for cm in cms:
+            stack.enter_context(cm)
+        yield