conduct-cli 0.7.2__tar.gz → 0.7.4__tar.gz

{conduct_cli-0.7.2 → conduct_cli-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.2
+Version: 0.7.4
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -152,6 +152,37 @@ That's it. Policy enforcement is active from the next tool call.
 | `conduct guard sync` | Pull latest policy, write hook to `~/.conductguard/hook.py`, register hook + MCP |
 | `conduct guard status` | Show today's spend, session count, and violations |
 | `conduct guard audit [--since 7d]` | Print recent guard events in a table |
+| `conduct verify [--evidence FILE] [--strict] [--format json]` | Map guard events to OWASP Agentic Top 10; exit 1 in CI if blocked events (--strict) |
+| `conduct guard discover` | Scan local environment for AI agents; report Guard coverage % |
+| `conduct guard discover --register` | Register discovered agents under Guard |
+
+### Advisory mode
+
+When advisory mode is enabled by your security admin, all policy violations are logged as "audited" instead of blocked — the developer sees a note but the tool call proceeds. The hook still posts every event to the audit log.
+
+To check if advisory mode is active:
+```bash
+conduct guard sync   # shows "· advisory" badge if active
+conduct guard status
+```
+
+### conduct verify
+
+```bash
+# Map last 24h of guard events to OWASP Agentic Top 10
+conduct verify
+
+# Use a saved evidence file
+conduct verify --evidence ./conduct-evidence.json
+
+# CI mode — exit 1 if any blocked events
+conduct verify --strict
+
+# JSON output for downstream tooling
+conduct verify --format json
+```
+
+OWASP mapping: `no-rm-rf` → A04 Excessive Agency, `no-sudo` → A09 Privilege Escalation, `policy_signature_invalid` → A07 Insufficient Monitoring, etc. All 10 categories covered.
 
 ### How the PreToolUse hook works
 

{conduct_cli-0.7.2 → conduct_cli-0.7.4}/README.md

@@ -124,6 +124,37 @@ That's it. Policy enforcement is active from the next tool call.
 | `conduct guard sync` | Pull latest policy, write hook to `~/.conductguard/hook.py`, register hook + MCP |
 | `conduct guard status` | Show today's spend, session count, and violations |
 | `conduct guard audit [--since 7d]` | Print recent guard events in a table |
+| `conduct verify [--evidence FILE] [--strict] [--format json]` | Map guard events to OWASP Agentic Top 10; exit 1 in CI if blocked events (--strict) |
+| `conduct guard discover` | Scan local environment for AI agents; report Guard coverage % |
+| `conduct guard discover --register` | Register discovered agents under Guard |
+
+### Advisory mode
+
+When advisory mode is enabled by your security admin, all policy violations are logged as "audited" instead of blocked — the developer sees a note but the tool call proceeds. The hook still posts every event to the audit log.
+
+To check if advisory mode is active:
+```bash
+conduct guard sync   # shows "· advisory" badge if active
+conduct guard status
+```
+
+### conduct verify
+
+```bash
+# Map last 24h of guard events to OWASP Agentic Top 10
+conduct verify
+
+# Use a saved evidence file
+conduct verify --evidence ./conduct-evidence.json
+
+# CI mode — exit 1 if any blocked events
+conduct verify --strict
+
+# JSON output for downstream tooling
+conduct verify --format json
+```
+
+OWASP mapping: `no-rm-rf` → A04 Excessive Agency, `no-sudo` → A09 Privilege Escalation, `policy_signature_invalid` → A07 Insufficient Monitoring, etc. All 10 categories covered.
 
 ### How the PreToolUse hook works
 

{conduct_cli-0.7.2 → conduct_cli-0.7.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.2"
+version = "0.7.4"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.2 → conduct_cli-0.7.4}/src/conduct_cli/guard.py

@@ -1699,7 +1699,8 @@ def cmd_guard_status(args):
     violations = [e for e in events if e.get("decision") == "blocked"]
 
     # Format spend figures
-    sessions        = spend.get("sessions", 0)
+    proxy_sessions  = spend.get("sessions", 0)
+    hook_sessions   = spend.get("hook_sessions", 0)
     tokens_used     = spend.get("tokens_used", 0)
     token_saved_pct = spend.get("token_saved_pct", 0)
     cost            = spend.get("cost_usd", 0.0)
@@ -1707,14 +1708,16 @@ def cmd_guard_status(args):
 
     viol_summary = ""
     if violations:
-        rule_names = ", ".join(v.get("rule", "unknown") for v in violations[:3])
+        rule_names = ", ".join(v.get("rule_id") or v.get("rule", "unknown") for v in violations[:3])
         viol_summary = f"  ({rule_names} — blocked)"
 
+    session_str = f"{proxy_sessions} proxy  ·  {hook_sessions} direct"
+
     print(f"\n{BOLD}Guard status{RESET} — {user_email}")
     print(f"{rule_count} polic{'y' if rule_count == 1 else 'ies'} active")
     print()
     print(f"Today:")
-    print(f"  Sessions: {sessions}")
+    print(f"  Sessions: {session_str}")
     print(f"  Tokens used: {tokens_used:,}  (saved {token_saved_pct}% via optimization)")
     print(f"  Cost: ${cost:.2f}  (saved ${cost_saved:.2f})")
     print(f"  Violations: {len(violations)}{viol_summary}")
@@ -1927,16 +1930,28 @@ def _discover_config_agents() -> list[tuple]:
 
     def _mcp_registered(path: Path) -> bool:
         try:
+            if not path.exists():
+                return False
+            text = path.read_text()
+            if path.suffix == ".toml":
+                # conduct-mcp or conductai in mcp_servers section
+                return "conduct" in text and "mcp_servers" in text
             import json as _j
-            d = _j.loads(path.read_text()) if path.exists() else {}
+            d = _j.loads(text)
             return "conduct" in d.get("mcpServers", {})
         except Exception:
             return False
 
     def _hook_registered(path: Path) -> bool:
         try:
+            if not path.exists():
+                # Codex: check hooks.json sibling
+                hooks_path = path.parent / "hooks.json"
+                if hooks_path.exists():
+                    return "conductguard" in hooks_path.read_text()
+                return False
             import json as _j
-            d = _j.loads(path.read_text()) if path.exists() else {}
+            d = _j.loads(path.read_text())
             hooks = d.get("hooks", {})
             return any("conductguard" in str(h).lower() or "conduct" in str(h).lower()
                        for h in hooks.get("PreToolUse", []))
@@ -1946,7 +1961,7 @@ def _discover_config_agents() -> list[tuple]:
     # Known tool config locations
     TOOLS = [
         ("claude-code", home / ".claude",  home / ".claude"  / "settings.json", "mcp"),
-        ("codex",       home / ".codex",   home / ".codex"   / "mcp.json",       "mcp"),
+        ("codex",       home / ".codex",   home / ".codex"   / "config.toml",    "mcp"),
         ("cursor",      home / ".cursor",  home / ".cursor"  / "mcp.json",       "mcp"),
         ("windsurf",    home / ".codeium" / "windsurf", home / ".codeium" / "windsurf" / "mcp_config.json", "mcp"),
     ]

{conduct_cli-0.7.2 → conduct_cli-0.7.4}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.2
+Version: 0.7.4
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -152,6 +152,37 @@ That's it. Policy enforcement is active from the next tool call.
 | `conduct guard sync` | Pull latest policy, write hook to `~/.conductguard/hook.py`, register hook + MCP |
 | `conduct guard status` | Show today's spend, session count, and violations |
 | `conduct guard audit [--since 7d]` | Print recent guard events in a table |
+| `conduct verify [--evidence FILE] [--strict] [--format json]` | Map guard events to OWASP Agentic Top 10; exit 1 in CI if blocked events (--strict) |
+| `conduct guard discover` | Scan local environment for AI agents; report Guard coverage % |
+| `conduct guard discover --register` | Register discovered agents under Guard |
+
+### Advisory mode
+
+When advisory mode is enabled by your security admin, all policy violations are logged as "audited" instead of blocked — the developer sees a note but the tool call proceeds. The hook still posts every event to the audit log.
+
+To check if advisory mode is active:
+```bash
+conduct guard sync   # shows "· advisory" badge if active
+conduct guard status
+```
+
+### conduct verify
+
+```bash
+# Map last 24h of guard events to OWASP Agentic Top 10
+conduct verify
+
+# Use a saved evidence file
+conduct verify --evidence ./conduct-evidence.json
+
+# CI mode — exit 1 if any blocked events
+conduct verify --strict
+
+# JSON output for downstream tooling
+conduct verify --format json
+```
+
+OWASP mapping: `no-rm-rf` → A04 Excessive Agency, `no-sudo` → A09 Privilege Escalation, `policy_signature_invalid` → A07 Insufficient Monitoring, etc. All 10 categories covered.
 
 ### How the PreToolUse hook works