conduct-cli 0.7.14__tar.gz → 0.7.16__tar.gz

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.14
+Version: 0.7.16
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.14"
+version = "0.7.16"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/src/conduct_cli/guardmcp.py

@@ -183,14 +183,23 @@ def _maybe_sync() -> None:
 def _detect_surface(client_info: dict) -> str:
     """Map MCP clientInfo.name → ai_tool label sent to Guard API."""
     name = (client_info.get("name") or "").lower()
-    if "desktop" in name:
-        return "claude_desktop"
+    # ── Anthropic ─────────────────────────────────────────────────────────────
+    if "code" in name and "claude" in name:
+        return "claude-code"
+    if "desktop" in name and "claude" in name:
+        return "claude-desktop"
     if "work" in name or "teams" in name or "enterprise" in name:
-        return "claude_work"
+        return "claude-desktop"   # Claude for Work / Teams
     if "claude" in name:
-        return "claude_chat"
+        return "claude-ai"        # claude.ai web
+    # ── OpenAI ────────────────────────────────────────────────────────────────
+    if "chatgpt" in name or "openai" in name:
+        return "openai-chatgpt"
+    if "codex" in name and "desktop" in name:
+        return "codex-desktop"
     if "codex" in name:
-        return "codex"
+        return "codex-cli"
+    # ── Other IDEs ────────────────────────────────────────────────────────────
     if "cursor" in name:
         return "cursor"
     if "windsurf" in name:
@@ -259,9 +268,13 @@ def _match_policy(tool_name: str, tool_input: dict) -> dict | None:
     for rule in rules:
         match_tool = (rule.get("match_tool") or "*").lower()
         if match_tool != "*":
-            allowed = [t.strip() for t in match_tool.split(",")]
-            if tool_name.lower() not in allowed:
+            if tool_name.lower() not in [t.strip() for t in match_tool.split(",")]:
                 continue
+        match_ai = rule.get("match_ai_tool")
+        if match_ai:
+            surfaces = [s.strip().lower() for s in match_ai.split(",")]
+            if not any(s in ai_tool.lower() for s in surfaces):
+                continue  # rule targets a different surface
 
         pattern = rule.get("match_pattern")
         if pattern:

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/src/conduct_cli/hooks/base.py

@@ -74,24 +74,38 @@ def detect_repo() -> Optional[str]:
 
 
 def detect_ai_tool() -> str:
-    """Return a string identifying the active AI coding tool."""
+    """Return a string identifying the active AI coding tool / surface."""
     import os
+    # ── Anthropic ─────────────────────────────────────────────────────────────
     if os.environ.get("CLAUDE_CODE_ENTRYPOINT") or os.environ.get("CLAUDECODE"):
         return "claude-code"
-    if os.environ.get("CODEX_SESSION_ID") or os.environ.get("CODEX_CLI_VERSION"):
-        return "codex"
+    if os.environ.get("CLAUDE_DESKTOP_ENTRYPOINT") or os.environ.get("CLAUDE_DESKTOP"):
+        return "claude-desktop"
+    # ── OpenAI / Codex ────────────────────────────────────────────────────────
+    if os.environ.get("CODEX_CLI_VERSION") or os.environ.get("CODEX_SESSION_ID"):
+        return "codex-cli"
+    if os.environ.get("CODEX_DESKTOP") or os.environ.get("OPENAI_CODEX_DESKTOP"):
+        return "codex-desktop"
+    if os.environ.get("OPENAI_CHATGPT_MCP") or os.environ.get("CHATGPT_SESSION_ID"):
+        return "openai-chatgpt"
+    # ── TERM_PROGRAM ──────────────────────────────────────────────────────────
     term = os.environ.get("TERM_PROGRAM", "").lower()
     if term == "cursor":
         return "cursor"
     if term == "windsurf":
         return "windsurf"
+    # ── PATH heuristics ───────────────────────────────────────────────────────
     path = os.environ.get("PATH", "")
-    if "Codex.app" in path or "codex" in path.lower():
-        return "codex"
+    if "Codex.app" in path:
+        return "codex-desktop"
+    if "codex" in path.lower():
+        return "codex-cli"
     if "cursor" in path.lower():
         return "cursor"
     if "windsurf" in path.lower():
         return "windsurf"
+    if "claude" in path.lower():
+        return "claude-desktop"
     return "claude-code"
 
 

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/src/conduct_cli/hooks/pretooluse.py

@@ -325,11 +325,17 @@ def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
         input_text = json.dumps(tool_input)
     path_fields = [str(tool_input.get(f, "")) for f in ["file_path", "path", "command"]]
 
+    current_ai_tool = detect_ai_tool()
     for rule in rules:
         match_tool = (rule.get("match_tool") or "*").lower()
         if match_tool != "*":
             if tool_name not in [t.strip() for t in match_tool.split(",")]:
                 continue
+        match_ai = rule.get("match_ai_tool")
+        if match_ai:
+            surfaces = [s.strip().lower() for s in match_ai.split(",")]
+            if not any(s in current_ai_tool.lower() for s in surfaces):
+                continue
         pattern = rule.get("match_pattern")
         if pattern:
             try:

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.14
+Version: 0.7.16
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/src/conduct_cli.egg-info/SOURCES.txt

@@ -35,6 +35,7 @@ tests/test_guard_savings.py
 tests/test_hook_dispatch.py
 tests/test_journal_drain.py
 tests/test_log_util.py
+tests/test_proxy_coverage.py
 tests/test_proxy_env.py
 tests/test_signed_policy.py
 tests/test_switch.py

{conduct_cli-0.7.14 → conduct_cli-0.7.16}/tests/test_advisory_and_hook.py

@@ -542,3 +542,65 @@ class TestInvalidStdin:
         with pytest.raises(SystemExit) as exc:
             pt.main()
         assert exc.value.code == 0
+
+
+# ── Fail-closed: API unreachable (budget check path) ──────────────────────────
+
+class TestFailClosedApiUnreachable:
+    """fail_closed + policy exists + budget API unreachable → blocks with clear message."""
+
+    def test_api_unreachable_blocks_with_clear_message(self, monkeypatch, tmp_path, capsys):
+        import conduct_cli.hooks.pretooluse as pt
+        from io import StringIO
+
+        policy_file = tmp_path / "policy.json"
+        policy_file.write_text('{"rules": [], "fail_mode": "fail_closed"}')
+
+        monkeypatch.setattr(pt, "active_policy_path", lambda: policy_file)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_closed")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        # Budget cache miss, then API unreachable → returns (False, None)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (None, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+
+        posted: list[dict] = []
+        def _fake_post(tn, ti, decision, rule_id, msg, sid, **kw):
+            posted.append({"decision": decision, "rule_id": rule_id, "msg": msg})
+        monkeypatch.setattr(pt, "post_event", _fake_post)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        with pytest.raises(SystemExit) as exc:
+            pt.main()
+
+        assert exc.value.code == 2
+        assert posted[0]["decision"] == "blocked"
+        assert posted[0]["rule_id"] == "guard-unavailable"
+        # Message must say "unreachable", not "budget"
+        assert "unreachable" in posted[0]["msg"].lower()
+        assert "budget" not in posted[0]["msg"].lower()
+
+    def test_api_unreachable_fail_open_passes(self, monkeypatch, tmp_path):
+        """Same scenario but fail_open → should NOT block."""
+        import conduct_cli.hooks.pretooluse as pt
+        from io import StringIO
+
+        policy_file = tmp_path / "policy.json"
+        policy_file.write_text('{"rules": []}')
+
+        monkeypatch.setattr(pt, "active_policy_path", lambda: policy_file)
+        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_open")
+        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
+        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
+        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
+        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (None, None))
+        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
+        monkeypatch.setattr(pt, "post_event", lambda *a, **kw: None)
+        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
+
+        # Should not raise SystemExit(2) — exits 0 (allow)
+        try:
+            pt.main()
+        except SystemExit as e:
+            assert e.code == 0

conduct_cli-0.7.16/tests/test_proxy_coverage.py

@@ -0,0 +1,79 @@
+"""Tests for proxy coverage detection in guard status."""
+import io
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+
+def _run_coverage_block(env: dict, cfg: dict, env_file_exists: bool = True) -> str:
+    """Run only the proxy-coverage printing block from cmd_guard_status."""
+    import conduct_cli.guard as g
+
+    output = io.StringIO()
+    with patch.dict("os.environ", env, clear=True), \
+         patch.object(Path, "exists", return_value=env_file_exists):
+        proxy_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/") + "/proxy"
+        _env = env
+        anthropic_ok  = proxy_url in _env.get("ANTHROPIC_BASE_URL", "")
+        openai_ok     = proxy_url in _env.get("OPENAI_BASE_URL", "")
+        perplexity_ok = proxy_url in _env.get("PERPLEXITY_BASE_URL", "")
+
+        covered   = [n for n, ok in [("Anthropic", anthropic_ok), ("OpenAI", openai_ok), ("Perplexity", perplexity_ok)] if ok]
+        uncovered = [n for n, ok in [("Anthropic", anthropic_ok), ("OpenAI", openai_ok), ("Perplexity", perplexity_ok)] if not ok]
+
+        GREEN, YELLOW, RED, RESET, BOLD = "", "", "", "", ""
+
+        if covered and not uncovered:
+            line = f"active — {', '.join(covered)} routed through Guard proxy"
+        elif covered:
+            line = f"partial — {', '.join(covered)} covered · {', '.join(uncovered)} NOT intercepted"
+        elif env_file_exists:
+            line = "inactive — ~/.conduct/env exists but not sourced in this shell."
+        else:
+            line = "not configured — run: conduct guard sync"
+        return line
+
+
+_CFG = {"api_url": "https://api.conductai.ai"}
+_PROXY = "https://api.conductai.ai/proxy"
+
+
+def test_all_three_active():
+    env = {
+        "ANTHROPIC_BASE_URL":  _PROXY,
+        "OPENAI_BASE_URL":     f"{_PROXY}/openai",
+        "PERPLEXITY_BASE_URL": f"{_PROXY}/perplexity",
+    }
+    line = _run_coverage_block(env, _CFG)
+    assert line.startswith("active")
+    assert "Anthropic" in line
+    assert "OpenAI" in line
+    assert "Perplexity" in line
+
+
+def test_partial_coverage():
+    env = {"ANTHROPIC_BASE_URL": _PROXY}
+    line = _run_coverage_block(env, _CFG)
+    assert line.startswith("partial")
+    assert "Anthropic" in line
+    assert "NOT intercepted" in line
+    assert "OpenAI" in line
+
+
+def test_inactive_env_file_exists():
+    line = _run_coverage_block({}, _CFG, env_file_exists=True)
+    assert line.startswith("inactive")
+    assert "~/.conduct/env" in line
+
+
+def test_not_configured_no_env_file():
+    line = _run_coverage_block({}, _CFG, env_file_exists=False)
+    assert line.startswith("not configured")
+    assert "conduct guard sync" in line
+
+
+def test_wrong_proxy_url_not_counted():
+    """Env var pointing to a different proxy should not count as covered."""
+    env = {"ANTHROPIC_BASE_URL": "https://some-other-proxy.io"}
+    line = _run_coverage_block(env, _CFG, env_file_exists=True)
+    assert line.startswith("inactive")