conduct-cli 0.7.23__tar.gz → 0.7.25__tar.gz

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.23
+Version: 0.7.25
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.23"
+version = "0.7.25"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/src/conduct_cli/guard.py

@@ -335,7 +335,14 @@ def _load_guard_config(workspace_id: str | None = None) -> dict:
 
 def _save_guard_config(data: dict, workspace_id: str | None = None):
     CONDUCT_HOME.mkdir(parents=True, exist_ok=True)
-    CONFIG_PATH.write_text(json.dumps(data, indent=2))
+    existing = {}
+    if CONFIG_PATH.exists():
+        try:
+            existing = json.loads(CONFIG_PATH.read_text())
+        except Exception:
+            pass
+    existing.update(data)
+    CONFIG_PATH.write_text(json.dumps(existing, indent=2))
     CONFIG_PATH.chmod(0o600)
 
 
@@ -343,10 +350,10 @@ def _require_guard_config() -> dict:
     cfg = _load_guard_config()
     ws = cfg.get("workspace_id") or cfg.get("workspace")
     if not cfg or not ws:
-        print(f"{RED}Guard not connected. Run: conduct login --api-key <key>{RESET}", file=sys.stderr)
+        print(f"{RED}Guard not connected. Run: conduct login{RESET}", file=sys.stderr)
         sys.exit(0)
-    if not cfg.get("api_key"):
-        print(f"{RED}Guard config is missing API key. Re-run: conduct login --api-key <key>{RESET}", file=sys.stderr)
+    if not cfg.get("agent_token") and not cfg.get("api_key"):
+        print(f"{RED}Guard config is missing credentials. Run: conduct login{RESET}", file=sys.stderr)
         sys.exit(0)
     return cfg
 
@@ -1153,11 +1160,45 @@ def _check_and_upgrade_packages() -> None:
         print(f"  {YELLOW}Auto-update failed:{RESET} {e} — run: pip install --upgrade {' '.join(p for p,_,_ in stale)}")
 
 
+def _proactive_token_refresh() -> None:
+    """Refresh agent_token if it expires within 5 min. No-op if no refresh_token."""
+    cfg = _load_guard_config()
+    if not cfg.get("refresh_token"):
+        return
+    import datetime as _dt, json as _json
+    exp = cfg.get("token_expires_at", "")
+    try:
+        if exp and _dt.datetime.fromisoformat(exp) >= _dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(minutes=5):
+            return  # still valid
+    except ValueError:
+        pass
+    api_url = _api_url(cfg)
+    try:
+        req = urllib.request.Request(
+            f"{api_url}/auth/refresh",
+            data=_json.dumps({"refresh_token": cfg["refresh_token"]}).encode(),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            data = _json.loads(resp.read())
+        cfg["agent_token"]      = data["agent_token"]
+        cfg["refresh_token"]    = data["refresh_token"]
+        cfg["workspace_id"]     = data["workspace_id"]
+        cfg["workspace"]        = data["workspace_id"]
+        cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(hours=8)).isoformat()
+        _save_guard_config(cfg)
+    except Exception:
+        print(f"  {YELLOW}⚠ Token refresh failed — run `conduct login` if sync fails{RESET}")
+
+
 def cmd_guard_sync(args):
+    _proactive_token_refresh()
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
-    api_key      = cfg.get("api_key", "")
+    agent_token  = cfg.get("agent_token", "")
     base_url     = _api_url(cfg)
+    _token       = agent_token or None
 
     # Persona selection — prompt once, skip if already chosen
 
@@ -1169,7 +1210,7 @@ def cmd_guard_sync(args):
         policy = _req(
             "GET",
             f"{base_url}/guard/policies/sync?workspace_id={workspace_id}",
-            api_key=api_key,
+            token=_token,
         )
     except Exception as e:
         print(f"Guard sync skipped: {e}", file=sys.stderr)
@@ -1220,7 +1261,7 @@ def cmd_guard_sync(args):
         installed = _req(
             "GET",
             f"{base_url}/guard/config/installed?workspace_id={workspace_id}",
-            api_key=api_key,
+            token=_token,
         )
         fresh_agent_token = installed.get("agent_token") or ""
         if fresh_agent_token:
@@ -1238,7 +1279,7 @@ def cmd_guard_sync(args):
     if not proxy_url:
         try:
             import urllib.request as _ur, urllib.error as _ue
-            _headers = {"X-Api-Key": api_key, "Content-Type": "application/json"}
+            _headers = {"Content-Type": "application/json"}
             _token = cfg.get("agent_token", "")
             if _token:
                 _headers["Authorization"] = f"Bearer {_token}"
@@ -1305,7 +1346,7 @@ def cmd_guard_sync(args):
     _ensure_booster(Path.cwd())
 
     # Capture savings from RTK and Agent Booster
-    _report_savings(cfg, base_url, api_key)
+    _report_savings(cfg, base_url)
 
     # Report AI tool coverage
     try:
@@ -1327,14 +1368,14 @@ def cmd_guard_sync(args):
 
     print(f"\n{BOLD}Policy refreshed ({rule_count} rule(s)).{RESET}")
 
-    # Print Claude.ai remote MCP URL — requires one-time browser paste
+    # Print remote MCP URL for any MCP-compatible client
     agent_token = cfg.get("agent_token", "")
     if workspace_id and agent_token:
         mcp_url = "https://api.conductai.ai/guard/mcp"
-        print(f"\n{BOLD}Claude.ai{RESET} (one-time browser setup):")
-        print(f"  Settings → MCP Servers → Add custom server")
+        masked = agent_token[:13] + "•" * 20
+        print(f"\n{BOLD}MCP server{RESET} (Claude.ai, Cursor, Windsurf, any MCP client):")
         print(f"  URL:    {CYAN}{mcp_url}{RESET}")
-        print(f"  Auth:   {CYAN}Bearer {agent_token}{RESET}\n")
+        print(f"  Auth:   {CYAN}Bearer {masked}{RESET}  {GRAY}(run `conduct token` to reveal){RESET}\n")
 
 
 CONDUCT_DIR        = Path.home() / ".conduct"
@@ -1422,7 +1463,6 @@ def _post_local_findings(cfg: dict, base_url: str, findings: list[dict]) -> None
                 "user_email": cfg.get("user_email", ""),
                 "findings":   findings,
             },
-            api_key=cfg.get("api_key", ""),
             token=cfg.get("agent_token", ""),
         )
     except Exception as e:
@@ -1627,7 +1667,7 @@ def _ensure_booster(root: Path) -> None:
             pass
 
 
-def _report_savings(cfg: dict, base_url: str, api_key: str) -> None:
+def _report_savings(cfg: dict, base_url: str, api_key: str = "") -> None:
     import subprocess
 
     rtk_data = {}

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/src/conduct_cli/hooks/base.py

@@ -94,6 +94,20 @@ def detect_ai_tool() -> str:
         return "cursor"
     if term == "windsurf":
         return "windsurf"
+    # ── Ancestor process check — Claude Code spawns via zsh, so check grandparent
+    try:
+        import psutil as _psutil
+        _proc = _psutil.Process(os.getppid())
+        for _ in range(3):  # check up to 3 levels
+            _cmd = " ".join(_proc.cmdline()).lower()
+            _name = _proc.name().lower()
+            if ".claude/shell-snapshots" in _cmd or ("claude" in _cmd and "claude" in _name):
+                return "claude-code"
+            _proc = _proc.parent()
+            if _proc is None:
+                break
+    except Exception:
+        pass
     # ── PATH heuristics ───────────────────────────────────────────────────────
     path = os.environ.get("PATH", "")
     if "Codex.app" in path:

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/src/conduct_cli/hooks/pretooluse.py

@@ -110,7 +110,7 @@ def _post_signature_invalid_event(expected_sig, computed_sig, policy_version, ho
         cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
     except Exception:
         return
-    workspace_id = cfg.get("workspace_id")
+    workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
     if not workspace_id:
         return
     import platform as _platform
@@ -155,7 +155,7 @@ def _maybe_sync_policy() -> None:
     """Sync policy from daemon (instant) or remote API (once per minute). Never raises."""
     try:
         cfg = load_config()
-        workspace_id = cfg.get("workspace_id")
+        workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
         api_key      = cfg.get("api_key", "")
         api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
         if not workspace_id:
@@ -249,11 +249,11 @@ def _fetch_budget_status():
         cfg = json.loads(CONFIG_PATH.read_text()) if CONFIG_PATH.exists() else {}
     except Exception:
         return False, None
-    workspace_id  = cfg.get("workspace_id")
+    workspace_id  = cfg.get("workspace_id") or cfg.get("workspace")
     clerk_user_id = cfg.get("clerk_user_id") or ""
     api_url       = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     if not workspace_id:
-        return False, None
+        return False, "unconfigured"
     url = f"{api_url}/guard/spend/budget-check?workspace_id={workspace_id}"
     if clerk_user_id:
         url += f"&clerk_user_id={clerk_user_id}"
@@ -435,19 +435,10 @@ def main() -> None:
         post_event(tool_name, tool_input, "blocked", "guard-unavailable", msg, session_id, drain_via=_this_file)
         sys.exit(2)
 
-    # Hard budget cap (cached 5 min)
+    # Hard budget cap (cached 5 min) — only block if server explicitly says so
     hard_blocked, reason = _load_budget_cache()
     if hard_blocked is None:
         hard_blocked, reason = _fetch_budget_status()
-        if not hard_blocked and reason is None and _get_fail_mode() == "fail_closed":
-            tool_name  = (data.get("tool_name") or "").lower()
-            tool_input = data.get("tool_input") or {}
-            session_id = data.get("session_id")
-            msg = "[ConductGuard] Guard API unreachable — tool call blocked (fail-closed). Check your connection or ask your admin to set fail_open in Guard settings."
-            print(msg)
-            print(msg, file=sys.stderr)
-            post_event(tool_name, tool_input, "blocked", "guard-unavailable", msg, session_id, drain_via=_this_file)
-            sys.exit(2)
     if hard_blocked:
         msg = f"[ConductGuard] {reason or 'Budget hard cap reached. Contact your manager.'}"
         print(msg)

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/src/conduct_cli/main.py

@@ -97,6 +97,10 @@ def _load_config() -> dict:
 def _save_config(data: dict):
     CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
     CONFIG_PATH.write_text(json.dumps(data, indent=2))
+    try:
+        import os as _os; _os.chmod(CONFIG_PATH, 0o600)
+    except Exception:
+        pass
 
 
 def _resolve(args, key: str, config_key=None):
@@ -110,19 +114,21 @@ def _resolve(args, key: str, config_key=None):
 
 def _require_auth(args):
     """Return (server, workspace_id, api_key, token) — exit if not configured."""
-    server     = _resolve(args, "server")
-    workspace  = _resolve(args, "workspace")
+    cfg        = _load_config()
+    server     = _resolve(args, "server") or cfg.get("api_url", "")
+    workspace  = _resolve(args, "workspace") or cfg.get("workspace_id") or cfg.get("workspace")
     api_key    = _resolve(args, "api_key", "api_key")
-    token      = _resolve(args, "token")
+    # agent_token (new) takes precedence over legacy token
+    token      = _resolve(args, "token") or cfg.get("agent_token")
 
     if not server:
-        print(f"{RED}No server set. Run: conduct login --server <url> --api-key <key>{RESET}")
+        print(f"{RED}No server set. Run: conduct login{RESET}")
         sys.exit(1)
     if not workspace:
-        print(f"{RED}No workspace set. Run: conduct login --workspace <id>{RESET}")
+        print(f"{RED}No workspace set. Run: conduct login{RESET}")
         sys.exit(1)
     if not api_key and not token:
-        print(f"{RED}No credentials. Run: conduct login --api-key <key>{RESET}")
+        print(f"{RED}Not authenticated. Run: conduct login{RESET}")
         sys.exit(1)
 
     return server.rstrip("/"), workspace, api_key, token
@@ -414,84 +420,126 @@ def cmd_mcp_install(args):
         pass
 
 
-def cmd_login(args):
-    server    = args.server
-    api_key   = args.api_key
-    workspace = args.workspace
-    token     = args.token
+_DEFAULT_API_URL = "https://api.conductai.ai"
+_DEFAULT_WEB_URL = "https://app.conductai.ai"
 
-    if not server and not api_key and not workspace:
-        cfg = _load_config()
-        if cfg:
-            print(f"{BOLD}Current config ({CONFIG_PATH}):{RESET}")
-            print(f"  server:    {cfg.get('server', '—')}")
-            print(f"  workspace: {cfg.get('workspace', '—')}")
-            print(f"  api_key:   {'set' if cfg.get('api_key') else '—'}")
-        else:
-            print("No config found. Run: conduct login --server <url> --api-key <key> --workspace <id>")
-        return
 
-    cfg = _load_config()
-    if server:    cfg["server"]    = server.rstrip("/")
-    if api_key:   cfg["api_key"]   = api_key
-    if workspace: cfg["workspace"] = workspace
-    if token:     cfg["token"]     = token
+def _find_free_port() -> int:
+    import socket
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
 
-    s   = cfg["server"]
-    ak  = cfg.get("api_key")
-    tok = cfg.get("token")
 
-    # Fetch identity from API key — always refresh email/user_id
-    if ak and ak.startswith("cond_live_"):
-        try:
-            hdrs = {"X-Api-Key": ak, "Content-Type": "application/json"}
-            me = api.req("GET", f"{s}/me", hdrs)
-            cfg["workspace"] = me["workspace_id"]
-            if me.get("user_id"):
-                cfg["user_id"] = me["user_id"]
-            if me.get("email"):
-                cfg["email"] = me["email"]
-            if not cfg.get("workspace"):
-                print(f"{GREEN}✓ Workspace discovered:{RESET} {cfg['workspace']}")
-        except SystemExit:
-            if not cfg.get("workspace"):
-                print(f"{YELLOW}⚠ Could not auto-discover workspace. Pass --workspace <id> manually.{RESET}")
+def _web_login_flow(api_url: str, web_url: str) -> dict:
+    """Open browser → localhost callback → return {agent_token, refresh_token, workspace_id}."""
+    import http.server
+    import secrets
+    import threading
+    import webbrowser
 
-    ws  = cfg.get("workspace", "")
-    if ws and (ak or tok):
-        hdrs = api.headers(ws, tok, "application/json", ak)
-        try:
-            api.req("GET", f"{s}/workflows", hdrs)
-            print(f"{GREEN}✓ Connected to {s}{RESET}")
-        except SystemExit:
-            print(f"{RED}Could not connect — check your server URL, workspace ID, and API key.{RESET}")
-            sys.exit(1)
+    state = secrets.token_urlsafe(16)
+    port  = _find_free_port()
+    result: dict = {}
+    event = threading.Event()
 
-    _save_config(cfg)
-    print(f"{GREEN}✓ Config saved to {CONFIG_PATH}{RESET}")
+    class _Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            parsed = urllib.parse.urlparse(self.path)
+            params = dict(urllib.parse.parse_qsl(parsed.query))
 
-    # Auto-install Guard if available for this workspace
-    if ak and ak.startswith("cond_live_"):
-        try:
-            from conduct_cli.guard import cmd_guard_install
-            import types
-            fake_args = types.SimpleNamespace(api_key=ak, server=s)
-            cmd_guard_install(fake_args)
-        except SystemExit:
-            pass  # Guard not found — skip silently
-        except Exception:
-            pass  # Never block login on Guard errors
+            if parsed.path != "/callback":
+                self.send_response(404)
+                self.end_headers()
+                return
+
+            # Respond immediately so browser shows success
+            body = b"<html><body><h2>Login successful. You can close this tab.</h2></body></html>"
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+            if params.get("state") == state:
+                result.update(params)
+            event.set()
+
+        def log_message(self, *_):
+            pass  # silence server logs
+
+    server = http.server.HTTPServer(("127.0.0.1", port), _Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    auth_url = f"{web_url}/cli-auth?port={port}&state={state}&api={urllib.parse.quote(api_url, safe='')}"
+    print(f"\n{BOLD}Opening browser for authentication…{RESET}")
+    print(f"{GRAY}If the browser didn't open, visit:{RESET}")
+    print(f"  {CYAN}{auth_url}{RESET}\n")
+    webbrowser.open(auth_url)
+
+    if not event.wait(timeout=300):
+        server.shutdown()
+        print(f"{RED}Login timed out (5 min). Try again.{RESET}")
+        sys.exit(1)
+
+    server.shutdown()
+
+    if not result.get("agent_token") or not result.get("workspace_id"):
+        print(f"{RED}Login failed — missing token in callback. Try again.{RESET}")
+        sys.exit(1)
 
-    # Auto-register MCP servers in Claude Code / Codex
+    return result
+
+
+def _token_login_flow(agent_token: str, api_url: str) -> dict:
+    """Manual --token flow: validate token against API and return workspace info."""
+    hdrs = {"Authorization": f"Bearer {agent_token}", "Content-Type": "application/json"}
     try:
-        import types
-        cmd_mcp_install(types.SimpleNamespace())
-    except Exception:
-        pass  # Never block login on MCP registration errors
+        me = api.req("GET", f"{api_url}/me", hdrs)
+        return {"agent_token": agent_token, "workspace_id": me.get("workspace_id", "")}
+    except SystemExit:
+        print(f"{RED}Token rejected by server. Check your token and try again.{RESET}")
+        sys.exit(1)
+
+
+def cmd_login(args):
+    api_url = (getattr(args, "server", None) or _load_config().get("api_url", _DEFAULT_API_URL)).rstrip("/")
+    web_url = _DEFAULT_WEB_URL
+
+    # --token escape hatch: paste agent_token directly (no browser)
+    manual_token = getattr(args, "token", None)
+    if manual_token:
+        if not manual_token.startswith("cond_agt_"):
+            print(f"{RED}Invalid token format. Expected cond_agt_... token from the dashboard.{RESET}")
+            sys.exit(1)
+        result = _token_login_flow(manual_token, api_url)
+    else:
+        result = _web_login_flow(api_url, web_url)
+
+    # Write config
+    import datetime as _dt
+    cfg = _load_config()
+    cfg["api_url"]          = api_url
+    cfg["agent_token"]      = result["agent_token"]
+    cfg["workspace"]        = result["workspace_id"]
+    cfg["workspace_id"]     = result["workspace_id"]
+    cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(hours=8)).isoformat()
+    if result.get("refresh_token"):
+        cfg["refresh_token"] = result["refresh_token"]
+    # Clear legacy api_key — agent_token is the credential now
+    cfg.pop("api_key", None)
+    _atomic_write(CONFIG_PATH, cfg)
 
-    # Report tool coverage to Guard
+    print(f"{GREEN}✓ Logged in{RESET} — workspace {GRAY}{result['workspace_id']}{RESET}")
+
+    # Auto-sync: register hooks + pull policy
     try:
-        _report_tool_coverage()
+        import conduct_cli.guard as _g
+        import types
+        _g.cmd_guard_sync(types.SimpleNamespace())
+    except SystemExit:
+        pass
     except Exception:
         pass
 
@@ -1248,6 +1296,10 @@ def _atomic_write(path: Path, data: dict) -> None:
     tmp = path.with_suffix(".tmp")
     tmp.write_text(json.dumps(data, indent=2))
     os.replace(tmp, path)
+    try:
+        os.chmod(path, 0o600)
+    except Exception:
+        pass
 
 
 def cmd_switch(args):
@@ -1316,7 +1368,7 @@ def cmd_switch(args):
     new_name = chosen["name"]
 
     # Update ~/.conduct/config.json atomically
-    cfg["workspace"] = new_id
+    cfg["workspace"] = new_id; cfg["workspace_id"] = new_id
     _atomic_write(CONFIG_PATH, cfg)
 
 
@@ -2428,9 +2480,48 @@ def cmd_run(args):
 
 # ── conduct sync / test-guard / test-security ────────────────────────────────
 
+def _refresh_agent_token() -> bool:
+    """Silently rotate agent_token using refresh_token. Returns True if refreshed."""
+    cfg = _load_config()
+    refresh_token = cfg.get("refresh_token", "")
+    if not refresh_token:
+        return False
+    api_url = cfg.get("api_url", _DEFAULT_API_URL).rstrip("/")
+    try:
+        import json as _json
+        req = urllib.request.Request(
+            f"{api_url}/auth/refresh",
+            data=_json.dumps({"refresh_token": refresh_token}).encode(),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            data = _json.loads(resp.read())
+        import datetime as _dt
+        cfg["agent_token"]      = data["agent_token"]
+        cfg["refresh_token"]    = data["refresh_token"]
+        cfg["workspace"]        = data["workspace_id"]
+        cfg["workspace_id"]     = data["workspace_id"]
+        cfg["token_expires_at"] = (_dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(hours=8)).isoformat()
+        _atomic_write(CONFIG_PATH, cfg)
+        return True
+    except Exception:
+        return False
+
+
 def cmd_sync(args):
     """Sync Guard policies (and Security Loop policies if installed)."""
     import conduct_cli.guard as _g
+    # Proactive refresh if token expires within 5 min
+    cfg = _load_config()
+    if cfg.get("refresh_token"):
+        import datetime as _dt
+        exp = cfg.get("token_expires_at", "")
+        try:
+            if not exp or _dt.datetime.fromisoformat(exp) < _dt.datetime.now(_dt.timezone.utc) + _dt.timedelta(minutes=5):
+                _refresh_agent_token()
+        except ValueError:
+            pass
     print(f"\n{BOLD}▶ conduct sync{RESET}\n")
     _g.cmd_guard_sync(args)
     print(f"\n{GREEN}Sync complete.{RESET}\n")
@@ -2928,11 +3019,9 @@ def main():
     sub = parser.add_subparsers(dest="command")
 
     # conduct login
-    login_p = sub.add_parser("login", help="Save connection config (~/.conduct/config.json)")
-    login_p.add_argument("--server",    help="API base URL e.g. https://api.conductai.ai")
-    login_p.add_argument("--api-key",   dest="api_key", help="CLI API key (set CLI_API_KEY on server)")
-    login_p.add_argument("--workspace", help="Workspace ID (auto-discovered from API key if omitted)")
-    login_p.add_argument("--token",     help=argparse.SUPPRESS)
+    login_p = sub.add_parser("login", help="Authenticate with Conduct (opens browser)")
+    login_p.add_argument("--server", help="API base URL (default: https://api.conductai.ai)")
+    login_p.add_argument("--token",  help="Paste an agent token directly instead of opening a browser")
 
     # conduct agents
     agents_p = sub.add_parser("agents", help="List all agents")
@@ -3037,6 +3126,9 @@ def main():
     switch_p.add_argument("workspace", nargs="?", metavar="name_or_id",
                           help="Workspace name or UUID prefix to switch to (omit to list)")
 
+    # conduct token show
+    sub.add_parser("token", help="Show your agent token (masked by default)")
+
     # conduct whoami
     sub.add_parser("whoami", help="Show current workspace, server, API key, and Guard/Booster status")
 
@@ -3140,6 +3232,16 @@ def main():
         cmd_run(args)
     elif args.command == "switch":
         cmd_switch(args)
+    elif args.command == "token":
+        cfg = _load_config()
+        token = cfg.get("agent_token", "")
+        if not token:
+            print(f"{RED}No agent token found. Run: conduct login{RESET}")
+            sys.exit(1)
+        print(f"\n{BOLD}Agent token{RESET} (paste as Bearer value in MCP server auth):\n")
+        print(f"  {CYAN}Bearer {token}{RESET}\n")
+        print(f"{GRAY}Token expires: {cfg.get('token_expires_at', 'unknown')}{RESET}")
+        print(f"{GRAY}Workspace:     {cfg.get('workspace_id', '')}{RESET}\n")
     elif args.command == "whoami":
         cmd_whoami(args)
     elif args.command == "sessions":

{conduct_cli-0.7.23 → conduct_cli-0.7.25}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.23
+Version: 0.7.25
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT