conduct-cli 0.7.10__tar.gz → 0.7.11__tar.gz

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.10
+Version: 0.7.11
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.10"
+version = "0.7.11"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/src/conduct_cli/hooks/base.py

@@ -211,6 +211,7 @@ def post_event(
     session_id: Optional[str] = None,
     *,
     drain_via: Optional[Path] = None,
+    blast_radius: "dict | None" = None,
 ) -> None:
     """Post one guard event via the journal/drain pattern.  Never raises.
 
@@ -235,6 +236,7 @@ def post_event(
         "hook_session_id": session_id,
         "os_info":         _os_info,
         "hostname":        _platform.node(),
+        "blast_radius":    blast_radius,
     })
     api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     journal_append(payload, api_url)

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/src/conduct_cli/hooks/posttooluse.py

@@ -247,7 +247,51 @@ def _scan_codex_tokens(transcript_path: str):
     return 0, 0
 
 
-def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms) -> None:
+def _compute_blast_radius(tool_name: str, tool_input: dict, tool_response: str) -> "dict | None":
+    """Classify blast radius after tool execution. Returns None for read-only tools."""
+    import re as _re
+
+    READ_ONLY = {"read", "ls", "glob", "search", "grep", "websearch", "webfetch", "computer"}
+    if tool_name in READ_ONLY:
+        return None
+
+    files = 0
+    symbols: "int | None" = None
+    tier = "local"
+
+    if tool_name in ("bash", "terminal"):
+        cmd = (tool_input.get("command") or "").lower()
+        if _re.search(r"\brm\s+.*-rf|\brm\s+-rf", cmd):
+            tier = "destructive"
+        elif _re.search(r"\bgit\s+(push|commit|merge|rebase|reset|tag)\b", cmd):
+            tier = "repo"
+        elif _re.search(r"\b(curl|wget|fetch)\b|https?://", cmd):
+            tier = "network"
+        # count path-like lines in output as proxy for files touched
+        lines = (tool_response or "").splitlines()
+        files = min(sum(1 for l in lines if "/" in l or ("." in l and len(l) < 200)), 50)
+
+    elif tool_name in ("write",):
+        files = 1
+        content = tool_input.get("content") or ""
+        symbols = len(content.splitlines()) or None
+
+    elif tool_name in ("edit", "str_replace_based_edit_tool", "str_replace_editor"):
+        files = 1
+        new_str = tool_input.get("new_string") or tool_input.get("new_content") or ""
+        symbols = len(new_str.splitlines()) or None
+
+    elif tool_name in ("multiedit",):
+        edits = tool_input.get("edits") or []
+        files = len(edits)
+
+    else:
+        files = 1  # unknown write-like tool
+
+    return {"files": files, "symbols": symbols, "tier": tier}
+
+
+def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms, blast_radius=None) -> None:
     """Fire-and-forget POST to /guard/events/usage."""
     cfg = load_config()
     workspace_id = cfg.get("workspace_id")
@@ -261,6 +305,7 @@ def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms)
         "tokens_output":   tokens_output,
         "duration_ms":     duration_ms,
         "ai_tool":         detect_ai_tool(),
+        "blast_radius":    blast_radius,
     })
     api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     script = (
@@ -300,7 +345,7 @@ def post_codex_main() -> None:
     transcript_path = args.get("transcript_path", "")
     tokens_in, tokens_out = _scan_codex_tokens(transcript_path)
     if tokens_in or tokens_out:
-        _post_usage(args.get("session_id"), args.get("tool_name"), tokens_in, tokens_out, None)
+        _post_usage(args.get("session_id"), args.get("tool_name"), tokens_in, tokens_out, None, args.get("blast_radius"))
     sys.exit(0)
 
 
@@ -320,6 +365,10 @@ def main() -> None:
     is_codex      = (tool_use_id or "").startswith("call_")
     session_id    = data.get("session_id") or (f"transcript:{transcript_path}" if transcript_path else None)
 
+    tool_response = data.get("tool_response") or data.get("output") or ""
+    tool_input    = data.get("tool_input") or {}
+    blast_radius  = _compute_blast_radius(tool_name, tool_input, str(tool_response))
+
     if is_codex and transcript_path:
         import uuid as _uuid
         pending = GUARD_DIR / f"codex_pending_{_uuid.uuid4().hex[:8]}.json"
@@ -328,6 +377,7 @@ def main() -> None:
                 "session_id":      session_id,
                 "tool_name":       tool_name,
                 "transcript_path": transcript_path,
+                "blast_radius":    blast_radius,
             }))
             subprocess.Popen(
                 [sys.executable, str(_this_file), "post-codex", str(pending)],
@@ -339,7 +389,7 @@ def main() -> None:
             pass
     elif transcript_path:
         tokens_input, tokens_output = _read_tokens_from_transcript(transcript_path, tool_use_id)
-        _post_usage(session_id, tool_name, tokens_input, tokens_output, None)
+        _post_usage(session_id, tool_name, tokens_input, tokens_output, None, blast_radius)
         _, action, rule_id, message = check_policy(tool_name, {}, tokens_before=tokens_input)
         if action in ("warn", "block"):
             decision = "warned" if action == "warn" else "blocked"
@@ -348,10 +398,7 @@ def main() -> None:
             else:
                 if action == "warn" and session_id and rule_id:
                     _record_session_warn(session_id, rule_id)
-                post_event(tool_name, {}, decision, rule_id, message, session_id, drain_via=_this_file)
-
-    tool_response = data.get("tool_response") or data.get("output") or ""
-    tool_input    = data.get("tool_input") or {}
+                post_event(tool_name, {}, decision, rule_id, message, session_id, drain_via=_this_file, blast_radius=blast_radius)
     _maybe_emit_security_finding(str(tool_response), session_id, tool_name, tool_input)
 
     sys.exit(0)

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.10
+Version: 0.7.11
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/src/conduct_cli.egg-info/SOURCES.txt

@@ -27,11 +27,11 @@ src/conduct_cli/hooks/session_start.py
 src/conduct_cli/hooks/stop.py
 tests/test_advisory_and_hook.py
 tests/test_bash_operator_signature.py
+tests/test_blast_radius.py
 tests/test_command_word_matcher.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py
 tests/test_hook_dispatch.py
-tests/test_hook_syntax.py
 tests/test_journal_drain.py
 tests/test_log_util.py
 tests/test_proxy_env.py

conduct_cli-0.7.11/tests/test_blast_radius.py

@@ -0,0 +1,44 @@
+"""Tests for _compute_blast_radius."""
+from conduct_cli.hooks.posttooluse import _compute_blast_radius
+
+
+def test_bash_rm_rf_is_destructive():
+    r = _compute_blast_radius("bash", {"command": "rm -rf apps/web/.next"}, "")
+    assert r["tier"] == "destructive"
+
+
+def test_bash_git_push_is_repo():
+    r = _compute_blast_radius("bash", {"command": "git push origin main"}, "")
+    assert r["tier"] == "repo"
+
+
+def test_bash_curl_is_network():
+    r = _compute_blast_radius("bash", {"command": "curl https://api.example.com"}, "")
+    assert r["tier"] == "network"
+
+
+def test_bash_local_counts_file_lines():
+    output = "src/foo.py\nsrc/bar.py\nDone"
+    r = _compute_blast_radius("bash", {"command": "ls"}, output)
+    assert r["tier"] == "local"
+    assert r["files"] == 2
+
+
+def test_write_returns_local_with_symbols():
+    r = _compute_blast_radius("write", {"content": "line1\nline2\nline3"}, "")
+    assert r["files"] == 1
+    assert r["symbols"] == 3
+    assert r["tier"] == "local"
+
+
+def test_read_returns_none():
+    assert _compute_blast_radius("read", {}, "") is None
+
+
+def test_grep_returns_none():
+    assert _compute_blast_radius("grep", {}, "") is None
+
+
+def test_multiedit_counts_edits():
+    r = _compute_blast_radius("multiedit", {"edits": [{}, {}, {}]}, "")
+    assert r["files"] == 3

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/tests/test_journal_drain.py

@@ -1,34 +1,32 @@
-"""Tests for #855-B: journal append + drain daemon logic."""
+"""Tests for journal append + drain daemon logic (conduct_cli.hooks.base)."""
 from __future__ import annotations
 import json
 import os
-import sys
 import time
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 import pytest
 
-import conduct_cli.hook_template as ht
+import conduct_cli.hooks.base as base
 
 
-# ── helpers ──────────────────────────────────────────────────────────────────
+# ── helpers ───────────────────────────────────────────────────────────────────
 
 def _patch_journal(tmp_path: Path):
-    """Return context managers that redirect JOURNAL_DIR/PID_PATH to tmp_path."""
     journal_dir = tmp_path / "journal"
     pid_path = journal_dir / "drain.pid"
     return (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
     )
 
 
-# ── _journal_append ───────────────────────────────────────────────────────────
+# ── journal_append ────────────────────────────────────────────────────────────
 
 def test_journal_append_creates_file(tmp_path):
     p1, p2 = _patch_journal(tmp_path)
     with p1, p2:
-        ht._journal_append('{"foo": 1}', "https://api.test")
+        base.journal_append('{"foo": 1}', "https://api.test")
         journal_dir = tmp_path / "journal"
         files = list(journal_dir.glob("*.json"))
         assert len(files) == 1
@@ -40,12 +38,12 @@ def test_journal_append_creates_file(tmp_path):
 def test_journal_append_no_tmp_files_left(tmp_path):
     p1, p2 = _patch_journal(tmp_path)
     with p1, p2:
-        ht._journal_append("{}", "https://api.test")
+        base.journal_append("{}", "https://api.test")
         journal_dir = tmp_path / "journal"
         assert not list(journal_dir.glob("*.tmp"))
 
 
-# ── _run_drain_daemon ─────────────────────────────────────────────────────────
+# ── run_drain_daemon ──────────────────────────────────────────────────────────
 
 def _write_journal_entry(journal_dir: Path, payload: str, api_url: str) -> Path:
     journal_dir.mkdir(parents=True, exist_ok=True)
@@ -62,12 +60,12 @@ def test_drain_posts_and_deletes_on_success(tmp_path):
 
     mock_resp = MagicMock()
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("urllib.request.urlopen", return_value=mock_resp),
-        patch("time.sleep"),  # skip sleeps
+        patch("time.sleep"),
     ):
-        ht._run_drain_daemon()
+        base.run_drain_daemon()
 
     assert not entry.exists(), "file should be deleted after successful POST"
 
@@ -78,12 +76,12 @@ def test_drain_leaves_file_on_network_failure(tmp_path):
     entry = _write_journal_entry(journal_dir, '{"x":1}', "https://api.test")
 
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("urllib.request.urlopen", side_effect=OSError("network down")),
-        patch("time.sleep"),  # skip sleeps so daemon exits after 3 all-fail scans
+        patch("time.sleep"),
     ):
-        ht._run_drain_daemon()
+        base.run_drain_daemon()
 
     assert entry.exists(), "file should survive a failed POST"
 
@@ -95,29 +93,29 @@ def test_drain_exits_after_three_empty_scans(tmp_path):
     sleep_calls = []
 
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("time.sleep", side_effect=lambda s: sleep_calls.append(s)),
     ):
-        ht._run_drain_daemon()
+        base.run_drain_daemon()
 
     assert len(sleep_calls) == 3, "should sleep exactly 3 times before exiting"
 
 
-# ── _ensure_drain_daemon ──────────────────────────────────────────────────────
+# ── ensure_drain_daemon ───────────────────────────────────────────────────────
 
 def test_ensure_drain_skips_spawn_when_alive(tmp_path):
     journal_dir = tmp_path / "journal"
     pid_path = journal_dir / "drain.pid"
     journal_dir.mkdir(parents=True, exist_ok=True)
-    pid_path.write_text(str(os.getpid()))  # our own PID — definitely alive
+    pid_path.write_text(str(os.getpid()))  # own PID — definitely alive
 
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("subprocess.Popen") as mock_popen,
     ):
-        ht._ensure_drain_daemon()
+        base.ensure_drain_daemon()
         mock_popen.assert_not_called()
 
 
@@ -125,14 +123,13 @@ def test_ensure_drain_spawns_when_pid_missing(tmp_path):
     journal_dir = tmp_path / "journal"
     pid_path = journal_dir / "drain.pid"
     journal_dir.mkdir(parents=True, exist_ok=True)
-    # no pid file written
 
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("subprocess.Popen") as mock_popen,
     ):
-        ht._ensure_drain_daemon()
+        base.ensure_drain_daemon(hook_module_path=Path(__file__))
         mock_popen.assert_called_once()
         args = mock_popen.call_args[0][0]
         assert args[-1] == "drain"
@@ -145,9 +142,9 @@ def test_ensure_drain_spawns_when_pid_stale(tmp_path):
     pid_path.write_text("99999999")  # almost certainly dead
 
     with (
-        patch.object(ht, "JOURNAL_DIR", journal_dir),
-        patch.object(ht, "JOURNAL_PID_PATH", pid_path),
+        patch.object(base, "JOURNAL_DIR", journal_dir),
+        patch.object(base, "JOURNAL_PID_PATH", pid_path),
         patch("subprocess.Popen") as mock_popen,
     ):
-        ht._ensure_drain_daemon()
+        base.ensure_drain_daemon(hook_module_path=Path(__file__))
         mock_popen.assert_called_once()

{conduct_cli-0.7.10 → conduct_cli-0.7.11}/tests/test_signed_policy.py

@@ -1,21 +1,29 @@
-"""Tests for #855-A (signed policy) and #855-C (fail-mode meta-rule)."""
+"""Tests for signed policy (#855-A) and fail-mode meta-rule (#855-C).
+
+Functions under test now live in conduct_cli.hooks.pretooluse;
+shared constants (SIGNING_KEY_PATH, etc.) live in conduct_cli.hooks.base.
+Patch targets follow Python's import-time binding rules:
+  - Constants used inside pretooluse functions → patch on `pre`
+  - Constants used inside base functions (load_config) → patch on `base`
+"""
 from __future__ import annotations
 import hashlib
 import hmac
 import json
 import time
+from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 import pytest
 
-import conduct_cli.hook_template as ht
+import conduct_cli.hooks.base as base
+import conduct_cli.hooks.pretooluse as pre
 
 
 # ── helpers ───────────────────────────────────────────────────────────────────
 
 def _make_key() -> tuple[bytes, str]:
-    """Return (key_bytes, hex_string) for a fresh signing key."""
     key = b"deadbeef" * 4  # 32 bytes
     return key, key.hex()
 
@@ -32,7 +40,15 @@ def _write_key(tmp_path: Path, key_hex: str) -> Path:
     return p
 
 
-# ── #855-A: _verify_policy_signature ─────────────────────────────────────────
+# ── _verify_policy_signature ──────────────────────────────────────────────────
+
+def _patch_verify(tmp_path, key_path):
+    """Patch both SIGNING_KEY_PATH and GUARD_DIR so path-traversal check passes."""
+    return (
+        patch.object(pre, "SIGNING_KEY_PATH", key_path),
+        patch.object(pre, "GUARD_DIR", tmp_path),
+    )
+
 
 def test_verify_passes_with_valid_signature(tmp_path):
     key_bytes, key_hex = _make_key()
@@ -40,11 +56,8 @@ def test_verify_passes_with_valid_signature(tmp_path):
     policy = {"version": "v1", "rules": []}
     policy["signature"] = _sign_policy(policy, key_bytes)
 
-    with (
-        patch.object(ht, "SIGNING_KEY_PATH", key_path),
-        patch.object(ht, "GUARD_DIR", tmp_path),
-    ):
-        assert ht._verify_policy_signature(policy) is True
+    with _ctx(*_patch_verify(tmp_path, key_path)):
+        assert pre._verify_policy_signature(policy) is True
 
 
 def test_verify_fails_with_wrong_signature(tmp_path):
@@ -52,11 +65,8 @@ def test_verify_fails_with_wrong_signature(tmp_path):
     key_path = _write_key(tmp_path, key_hex)
     policy = {"version": "v1", "rules": [], "signature": "badbadbadbad"}
 
-    with (
-        patch.object(ht, "SIGNING_KEY_PATH", key_path),
-        patch.object(ht, "GUARD_DIR", tmp_path),
-    ):
-        assert ht._verify_policy_signature(policy) is False
+    with _ctx(*_patch_verify(tmp_path, key_path)):
+        assert pre._verify_policy_signature(policy) is False
 
 
 def test_verify_fails_when_signature_missing_and_key_present(tmp_path):
@@ -64,11 +74,8 @@ def test_verify_fails_when_signature_missing_and_key_present(tmp_path):
     key_path = _write_key(tmp_path, key_hex)
     policy = {"version": "v1", "rules": []}  # no "signature" key
 
-    with (
-        patch.object(ht, "SIGNING_KEY_PATH", key_path),
-        patch.object(ht, "GUARD_DIR", tmp_path),
-    ):
-        assert ht._verify_policy_signature(policy) is False
+    with _ctx(*_patch_verify(tmp_path, key_path)):
+        assert pre._verify_policy_signature(policy) is False
 
 
 def test_verify_passes_when_no_key_file(tmp_path):
@@ -76,38 +83,27 @@ def test_verify_passes_when_no_key_file(tmp_path):
     key_path = tmp_path / "signing.key"  # does not exist
     policy = {"version": "v1", "rules": [], "signature": "anything"}
 
-    with (
-        patch.object(ht, "SIGNING_KEY_PATH", key_path),
-        patch.object(ht, "GUARD_DIR", tmp_path),
-    ):
-        assert ht._verify_policy_signature(policy) is True
+    with _ctx(*_patch_verify(tmp_path, key_path)):
+        assert pre._verify_policy_signature(policy) is True
 
 
 def test_verify_strips_signature_and_signed_at_before_computing(tmp_path):
-    """signed_at and signature fields must not be part of the signed body."""
     key_bytes, key_hex = _make_key()
     key_path = _write_key(tmp_path, key_hex)
     policy = {"version": "v1", "rules": [], "signed_at": "2026-01-01T00:00:00Z"}
     policy["signature"] = _sign_policy(policy, key_bytes)
-    # Add a different signed_at — should still verify because it's excluded from body
-    policy["signed_at"] = "2030-12-31T00:00:00Z"
+    policy["signed_at"] = "2030-12-31T00:00:00Z"  # mutated after signing
 
-    with (
-        patch.object(ht, "SIGNING_KEY_PATH", key_path),
-        patch.object(ht, "GUARD_DIR", tmp_path),
-    ):
-        assert ht._verify_policy_signature(policy) is True
+    with _ctx(*_patch_verify(tmp_path, key_path)):
+        assert pre._verify_policy_signature(policy) is True
 
 
-# ── #855-C: fail-mode meta-rule in _maybe_sync_policy ────────────────────────
+# ── _maybe_sync_policy ────────────────────────────────────────────────────────
 
 def _setup_sync(tmp_path, local_policy, remote_policy, key_hex=None):
-    """
-    Wire up _maybe_sync_policy with mocked HTTP + config + paths.
-    Returns the path objects so callers can assert on POLICY_PATH.
-    """
-    config_path = tmp_path / "config.json"
-    policy_path = tmp_path / "policy.json"
+    """Wire _maybe_sync_policy with mocked HTTP + config + paths."""
+    config_path   = tmp_path / "config.json"
+    policy_path   = tmp_path / "policy.json"
     version_cache = tmp_path / "version_cache.json"
 
     config_path.write_text(json.dumps({
@@ -118,85 +114,80 @@ def _setup_sync(tmp_path, local_policy, remote_policy, key_hex=None):
     if local_policy is not None:
         policy_path.write_text(json.dumps(local_policy))
 
-    # Mock urllib so "remote" is returned without a real HTTP call
     mock_resp = MagicMock()
     mock_resp.read.return_value = json.dumps(remote_policy).encode()
     mock_resp.__enter__ = lambda s: s
     mock_resp.__exit__ = MagicMock(return_value=False)
 
+    signing_key_path = tmp_path / "signing.key"
+    if key_hex:
+        signing_key_path.write_text(key_hex)
+
     patches = [
-        patch.object(ht, "CONFIG_PATH", config_path),
-        patch.object(ht, "POLICY_PATH", policy_path),
-        patch.object(ht, "VERSION_CACHE_PATH", version_cache),
-        patch.object(ht, "SIGNING_KEY_PATH", tmp_path / "signing.key"),
-        patch.object(ht, "GUARD_DIR", tmp_path),
+        patch.object(base, "CONFIG_PATH", config_path),         # for load_config()
+        patch.object(pre, "active_policy_path", return_value=policy_path),
+        patch.object(pre, "VERSION_CACHE_PATH", version_cache),
+        patch.object(pre, "SIGNING_KEY_PATH", signing_key_path),
+        patch.object(pre, "GUARD_DIR", tmp_path),               # for path-traversal check
         patch("urllib.request.urlopen", return_value=mock_resp),
-        patch.object(ht, "_daemon_alive", return_value=False),
-        # Disable journal side-effect from _post_signature_invalid_event
-        patch("subprocess.Popen"),
+        patch.object(pre, "_daemon_alive", return_value=False),
+        patch("subprocess.Popen"),  # suppress _post_signature_invalid_event side-effect
     ]
-    if key_hex:
-        (tmp_path / "signing.key").write_text(key_hex)
-
     return policy_path, patches
 
 
 def test_sync_rejects_tampered_policy(tmp_path):
-    """Tampered remote policy (bad sig) must not overwrite local policy."""
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
     remote = {"version": "v2", "rules": [], "signature": "badhash"}
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
-    saved = json.loads(policy_path.read_text())
-    assert saved["version"] == "v1", "tampered remote should not replace local policy"
+    assert json.loads(policy_path.read_text())["version"] == "v1"
 
 
 def test_sync_accepts_valid_signed_policy(tmp_path):
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
     remote = {"version": "v2", "rules": [], "fail_mode": "fail_open"}
     remote["signature"] = _sign_policy(remote, key_bytes)
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
-    saved = json.loads(policy_path.read_text())
-    assert saved["version"] == "v2"
+    assert json.loads(policy_path.read_text())["version"] == "v2"
 
 
 def test_failmode_downgrade_blocked_without_token(tmp_path):
-    """fail_closed → fail_open must be rejected if no downgrade token matches."""
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
-             "fail_mode_downgrade_token": "secret-abc"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+              "fail_mode_downgrade_token": "secret-abc"}
     remote = {"version": "v2", "rules": [], "fail_mode": "fail_open"}
     remote["signature"] = _sign_policy(remote, key_bytes)
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
     saved = json.loads(policy_path.read_text())
-    assert saved["fail_mode"] == "fail_closed", "downgrade without token must be rejected"
+    assert saved["fail_mode"] == "fail_closed"
     assert saved["version"] == "v1"
 
 
 def test_failmode_downgrade_blocked_with_wrong_token(tmp_path):
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
-             "fail_mode_downgrade_token": "secret-abc"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+              "fail_mode_downgrade_token": "secret-abc"}
     remote = {"version": "v2", "rules": [], "fail_mode": "fail_open",
               "fail_mode_downgrade_token": "wrong-token"}
     remote["signature"] = _sign_policy(remote, key_bytes)
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
     saved = json.loads(policy_path.read_text())
     assert saved["fail_mode"] == "fail_closed"
@@ -205,15 +196,15 @@ def test_failmode_downgrade_blocked_with_wrong_token(tmp_path):
 
 def test_failmode_downgrade_allowed_with_correct_token(tmp_path):
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
-             "fail_mode_downgrade_token": "secret-abc"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_closed",
+              "fail_mode_downgrade_token": "secret-abc"}
     remote = {"version": "v2", "rules": [], "fail_mode": "fail_open",
               "fail_mode_downgrade_token": "secret-abc"}
     remote["signature"] = _sign_policy(remote, key_bytes)
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
     saved = json.loads(policy_path.read_text())
     assert saved["fail_mode"] == "fail_open"
@@ -221,24 +212,21 @@ def test_failmode_downgrade_allowed_with_correct_token(tmp_path):
 
 
 def test_failmode_open_to_closed_always_allowed(tmp_path):
-    """Upgrading to fail_closed needs no token — only downgrade is gated."""
     key_bytes, key_hex = _make_key()
-    local = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
+    local  = {"version": "v1", "rules": [], "fail_mode": "fail_open"}
     remote = {"version": "v2", "rules": [], "fail_mode": "fail_closed"}
     remote["signature"] = _sign_policy(remote, key_bytes)
 
     policy_path, patches = _setup_sync(tmp_path, local, remote, key_hex)
     with _ctx(*patches):
-        ht._maybe_sync_policy()
+        pre._maybe_sync_policy()
 
     saved = json.loads(policy_path.read_text())
     assert saved["fail_mode"] == "fail_closed"
     assert saved["version"] == "v2"
 
 
-# ── tiny helper so we can unpack a list of context managers ──────────────────
-
-from contextlib import contextmanager, ExitStack
+# ── helper ────────────────────────────────────────────────────────────────────
 
 @contextmanager
 def _ctx(*cms):

conduct_cli-0.7.10/tests/test_hook_syntax.py

@@ -1,19 +0,0 @@
-"""Validate that all hook template files are syntactically valid Python.
-
-This test exists to catch the class of bug where escape sequences in embedded
-string literals break generated hook files. Since templates are now real .py
-files, py_compile catches any issue immediately.
-"""
-import py_compile
-from pathlib import Path
-
-TEMPLATES_DIR = Path(__file__).parent.parent / "src" / "conduct_cli"
-
-def test_hook_template_syntax():
-    py_compile.compile(str(TEMPLATES_DIR / "hook_template.py"), doraise=True)
-
-def test_precompact_template_syntax():
-    py_compile.compile(str(TEMPLATES_DIR / "hook_precompact_template.py"), doraise=True)
-
-def test_session_start_template_syntax():
-    py_compile.compile(str(TEMPLATES_DIR / "hook_session_start_template.py"), doraise=True)