conduct-cli 0.7.34__tar.gz → 0.7.36__tar.gz

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.34
+Version: 0.7.36
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.34"
+version = "0.7.36"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/guard.py

@@ -401,11 +401,17 @@ def _register_mcp(workspace_id: str, agent_token: str, api_url: str) -> None:
     if shutil.which("booster"):
         servers["agent-booster"] = {"command": "booster", "args": ["serve"]}
 
-    targets = list(_MCP_TARGETS) + _vscode_mcp_paths()
+    vscode_paths = _vscode_mcp_paths()
+    targets = list(_MCP_TARGETS) + vscode_paths
+    vscode_cfg_paths = {p for p, _ in vscode_paths}
     found_any = False
     for cfg_path, label in targets:
         if not cfg_path.exists():
-            continue
+            # Create mcp.json for VS Code if Copilot is confirmed installed
+            if cfg_path in vscode_cfg_paths:
+                cfg_path.write_text("{}")
+            else:
+                continue
         found_any = True
         try:
             existing = json.loads(cfg_path.read_text())
@@ -1878,6 +1884,9 @@ def cmd_guard_status(args):
         proxy_line = f"{RED}not configured{RESET} — run: {BOLD}conduct guard sync{RESET}"
 
     print(f"\n{BOLD}Guard status{RESET} — {user_email}")
+    _active_cfg = _load_guard_config()
+    if _active_cfg.get("current_goal_id"):
+        print(f"  Active goal: {CYAN}{_active_cfg.get('current_goal_name', 'unnamed')}{RESET}  ({_active_cfg['current_goal_id'][:8]}...)")
     print(f"{rule_count} polic{'y' if rule_count == 1 else 'ies'} active")
     print()
     print(f"Proxy coverage: {proxy_line}")
@@ -1931,6 +1940,32 @@ def cmd_guard_savings(args):
     print()
 
 
+def cmd_guard_session(args):
+    sub = getattr(args, "session_cmd", None)
+    if sub == "start":
+        import uuid as _uuid
+        goal = getattr(args, "goal", "") or ""
+        goal_id = str(_uuid.uuid4())
+        cfg = _load_guard_config()
+        cfg["current_goal_id"] = goal_id
+        cfg["current_goal_name"] = goal
+        _save_guard_config(cfg)
+        print(f"  {GREEN}Session started{RESET}")
+        if goal:
+            print(f"  Goal: {CYAN}{goal}{RESET}")
+        print(f"  ID:   {goal_id}")
+        print(f"\nAll Guard events in this session will be tagged with this goal.")
+        print(f"Run {BOLD}conduct guard session stop{RESET} when done.")
+    elif sub == "stop":
+        cfg = _load_guard_config()
+        name = cfg.pop("current_goal_name", "")
+        cfg.pop("current_goal_id", None)
+        _save_guard_config(cfg)
+        print(f"  {GREEN}Session stopped{RESET}" + (f" — {name}" if name else ""))
+    else:
+        print("Usage: conduct guard session start [--goal GOAL] | stop")
+
+
 def cmd_guard_audit(args):
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
@@ -2085,6 +2120,14 @@ def register_guard_parser(sub):
     lint_p.add_argument("--file", default=None, metavar="FILE",
                         help="Path to policy YAML/JSON (default: ~/.conduct/policy.json)")
 
+    # conduct guard session start|stop
+    p_session = guard_sub.add_parser("session", help="Start or stop a named goal session")
+    session_sub = p_session.add_subparsers(dest="session_cmd")
+    p_sess_start = session_sub.add_parser("start", help="Start a goal session — tags all Guard events with a goal ID")
+    p_sess_start.add_argument("--goal", default="", help="Human-readable goal label")
+    session_sub.add_parser("stop", help="End the current goal session")
+    p_session.set_defaults(func=cmd_guard_session)
+
     return guard_p, guard_sub
 
 
@@ -2683,6 +2726,9 @@ def _grade_below(actual: str, minimum: str) -> bool:
     return _GRADE_ORDER.index(actual) > _GRADE_ORDER.index(minimum.upper())
 
 
+_VERDICT_COLOR = {"held": GREEN, "bypassed": RED, "not_tested": YELLOW}
+
+
 def cmd_verify(args) -> None:
     """conduct verify — governance grade + OWASP Agentic Top 10 coverage."""
     import json as _json
@@ -2692,6 +2738,7 @@ def cmd_verify(args) -> None:
     min_grade    = getattr(args, "min_grade", None)
     strict       = getattr(args, "strict", False)
     fmt          = getattr(args, "format", "text")
+    run_battery  = getattr(args, "run", False)
 
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
@@ -2712,6 +2759,46 @@ def cmd_verify(args) -> None:
     controls     = ev.get("controls", [])
     generated_at = ev.get("generated_at", "")
 
+    # ── --run (live adversarial battery) ─────────────────────────────────────
+    run_result = None
+    if run_battery:
+        print(f"\n{BOLD}Running adversarial test battery…{RESET}")
+        run_result = _req(
+            "POST",
+            f"{base_url}/guard/verify/run?workspace_id={workspace_id}",
+            api_key=api_key,
+        )
+        if fmt == "json":
+            print(_json.dumps(run_result, indent=2))
+            return
+        rs      = run_result.get("score", 0)
+        rg      = run_result.get("grade", "F")
+        passed  = run_result.get("passed_tests", 0)
+        total   = run_result.get("total_tests", 0)
+        results = run_result.get("results", [])
+        rg_col  = _GRADE_COLORS.get(rg, GRAY)
+        print()
+        print(f"{BOLD}conduct verify --run — Live Adversarial Score{RESET}")
+        print("─" * 60)
+        print(f"\n  Live Grade: {rg_col}{BOLD}{rg}{RESET}  ({rs}/100) · {passed}/{total} held\n")
+        print(f"  {BOLD}{'ASI':<8} {'Verdict':<12} {'Expected':<10} {'Actual':<10} Test{RESET}")
+        print("  " + "─" * 56)
+        for r in results:
+            vc = _VERDICT_COLOR.get(r.get("verdict", ""), GRAY)
+            print(
+                f"  {r.get('asi',''):<8} "
+                f"{vc}{r.get('verdict',''):<12}{RESET} "
+                f"{r.get('expected',''):<10} "
+                f"{r.get('actual',''):<10} "
+                f"{r.get('name','')}"
+            )
+        print()
+        if min_grade and _grade_below(rg, min_grade):
+            print(f"  {RED}✗ Live grade {rg} is below minimum {min_grade.upper()}.{RESET}\n")
+            sys.exit(1)
+        print(f"  {GREEN}✓ PASS{RESET}\n")
+        return
+
     # ── --badge ───────────────────────────────────────────────────────────────
     if badge:
         color = {"A": "brightgreen", "B": "green", "C": "yellow", "D": "orange", "F": "red"}.get(grade, "lightgrey")
@@ -2797,6 +2884,8 @@ def dispatch_guard(args, guard_p):
         cmd_guard_booster_status(args)
     elif guard_command == "debug-hook":
         cmd_guard_debug_hook(args)
+    elif guard_command == "session":
+        cmd_guard_session(args)
     else:
         guard_p.print_help()
         sys.exit(1)

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/guardmcp.py

@@ -45,6 +45,7 @@ _TOOLS = [
             "number of active rules, and the policy version timestamp."
         ),
         "inputSchema": {"type": "object", "properties": {}, "required": []},
+        "annotations": {"readOnlyHint": True, "openWorldHint": False},
     },
     {
         "name": "guard_check",
@@ -75,6 +76,7 @@ _TOOLS = [
             },
             "required": ["tool_name"],
         },
+        "annotations": {"readOnlyHint": True, "openWorldHint": False},
     },
     {
         "name": "guard_sync",
@@ -83,6 +85,7 @@ _TOOLS = [
             "Run this after your security team updates policies."
         ),
         "inputSchema": {"type": "object", "properties": {}, "required": []},
+        "annotations": {"idempotentHint": True, "openWorldHint": True},
     },
     {
         "name": "guard_enable",
@@ -93,6 +96,7 @@ _TOOLS = [
             "should paste into their Claude.ai Project settings to make guard_check fire automatically."
         ),
         "inputSchema": {"type": "object", "properties": {}, "required": []},
+        "annotations": {"idempotentHint": True, "openWorldHint": False},
     },
     {
         "name": "guard_activity",
@@ -116,6 +120,7 @@ _TOOLS = [
             },
             "required": ["summary"],
         },
+        "annotations": {"openWorldHint": False},
     },
 ]
 
@@ -468,10 +473,13 @@ def main() -> None:
             _ok(msg_id, {"tools": _TOOLS})
 
         elif method == "tools/call":
-            tool_name  = params.get("name", "")
-            arguments  = params.get("arguments") or {}
-            text       = _dispatch_tool(tool_name, arguments, workspace_id, token, ai_tool)
-            _ok(msg_id, {"content": [{"type": "text", "text": text}]})
+            tool_name = params.get("name", "")
+            arguments = params.get("arguments") or {}
+            try:
+                text = _dispatch_tool(tool_name, arguments, workspace_id, token, ai_tool)
+                _ok(msg_id, {"content": [{"type": "text", "text": text}]})
+            except Exception as exc:
+                _ok(msg_id, {"content": [{"type": "text", "text": str(exc)}], "isError": True})
 
         elif method == "ping":
             _ok(msg_id, {})

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/hooks/base.py

@@ -309,6 +309,10 @@ def post_event(
         return
     import platform as _platform
     _os_info = f"{_platform.system()} {_platform.release()} {_platform.machine()}".strip()
+    # Read goal session fields directly from config — avoids circular import with guard.py
+    import json as _json_gcfg, pathlib as _pl_gcfg
+    _gcfg_path = _pl_gcfg.Path.home() / ".conduct" / "config.json"
+    _gcfg = _json_gcfg.loads(_gcfg_path.read_text()) if _gcfg_path.exists() else {}
     payload = json.dumps({
         "workspace_id":    workspace_id,
         "clerk_user_id":   cfg.get("user_email"),
@@ -323,6 +327,8 @@ def post_event(
         "os_info":         _os_info,
         "hostname":        _platform.node(),
         "blast_radius":    blast_radius,
+        "goal_id":         _gcfg.get("current_goal_id") or None,
+        "goal_name":       _gcfg.get("current_goal_name") or None,
     })
     api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     journal_append(payload, api_url)

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/hooks/posttooluse.py

@@ -247,6 +247,27 @@ def _scan_codex_tokens(transcript_path: str):
     return 0, 0
 
 
+def _git_context() -> "tuple[str | None, str | None]":
+    """Return (repo_url, branch) from git — best-effort, never raises."""
+    import subprocess as _sp
+    repo = branch = None
+    try:
+        repo = _sp.check_output(
+            ["git", "remote", "get-url", "origin"],
+            timeout=2, stderr=_sp.DEVNULL, text=True,
+        ).strip() or None
+    except Exception:
+        pass
+    try:
+        branch = _sp.check_output(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+            timeout=2, stderr=_sp.DEVNULL, text=True,
+        ).strip() or None
+    except Exception:
+        pass
+    return repo, branch
+
+
 def _compute_blast_radius(tool_name: str, tool_input: dict, tool_response: str) -> "dict | None":
     """Classify blast radius after tool execution. Returns None for read-only tools."""
     import re as _re
@@ -258,6 +279,7 @@ def _compute_blast_radius(tool_name: str, tool_input: dict, tool_response: str)
     files = 0
     symbols: "int | None" = None
     tier = "local"
+    file_paths: "list[str]" = []
 
     if tool_name in ("bash", "terminal"):
         cmd = (tool_input.get("command") or "").lower()
@@ -269,43 +291,55 @@ def _compute_blast_radius(tool_name: str, tool_input: dict, tool_response: str)
             tier = "network"
         # count path-like lines in output as proxy for files touched
         lines = (tool_response or "").splitlines()
-        files = min(sum(1 for l in lines if "/" in l or ("." in l and len(l) < 200)), 50)
+        path_lines = [l.strip() for l in lines if "/" in l or ("." in l and len(l) < 200)]
+        files = min(len(path_lines), 50)
+        file_paths = path_lines[:20]
 
     elif tool_name in ("write",):
         files = 1
         content = tool_input.get("content") or ""
         symbols = len(content.splitlines()) or None
+        fp = tool_input.get("file_path") or tool_input.get("path")
+        if fp:
+            file_paths = [fp]
 
     elif tool_name in ("edit", "str_replace_based_edit_tool", "str_replace_editor"):
         files = 1
         new_str = tool_input.get("new_string") or tool_input.get("new_content") or ""
         symbols = len(new_str.splitlines()) or None
+        fp = tool_input.get("file_path") or tool_input.get("path")
+        if fp:
+            file_paths = [fp]
 
     elif tool_name in ("multiedit",):
         edits = tool_input.get("edits") or []
         files = len(edits)
+        file_paths = [e.get("file_path") or e.get("path") for e in edits if e.get("file_path") or e.get("path")]
 
     else:
         files = 1  # unknown write-like tool
 
-    return {"files": files, "symbols": symbols, "tier": tier}
+    repo, branch = _git_context()
+    return {"files": files, "symbols": symbols, "tier": tier, "file_paths": file_paths, "repo": repo, "branch": branch}
 
 
-def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms, blast_radius=None) -> None:
+def _post_usage(session_id, tool_name, tokens_input, tokens_output, duration_ms, blast_radius=None, execution_status=None, result_summary=None) -> None:
     """Fire-and-forget POST to /guard/events/usage."""
     cfg = load_config()
     workspace_id = cfg.get("workspace_id")
     if not workspace_id or not session_id:
         return
     payload = json.dumps({
-        "workspace_id":    workspace_id,
-        "hook_session_id": session_id,
-        "tool_name":       tool_name,
-        "tokens_input":    tokens_input,
-        "tokens_output":   tokens_output,
-        "duration_ms":     duration_ms,
-        "ai_tool":         detect_ai_tool(),
-        "blast_radius":    blast_radius,
+        "workspace_id":     workspace_id,
+        "hook_session_id":  session_id,
+        "tool_name":        tool_name,
+        "tokens_input":     tokens_input,
+        "tokens_output":    tokens_output,
+        "duration_ms":      duration_ms,
+        "ai_tool":          detect_ai_tool(),
+        "blast_radius":     blast_radius,
+        "execution_status": execution_status,
+        "result_summary":   result_summary,
     })
     api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     script = (
@@ -369,6 +403,15 @@ def main() -> None:
     tool_input    = data.get("tool_input") or {}
     blast_radius  = _compute_blast_radius(tool_name, tool_input, str(tool_response))
 
+    # Derive execution outcome from hook data
+    _resp_str = str(tool_response)
+    if data.get("error") or "Error" in _resp_str[:100]:
+        execution_status = "error"
+        result_summary   = _resp_str[:200] or None
+    else:
+        execution_status = "success"
+        result_summary   = None
+
     if is_codex and transcript_path:
         import uuid as _uuid
         pending = GUARD_DIR / f"codex_pending_{_uuid.uuid4().hex[:8]}.json"
@@ -389,7 +432,7 @@ def main() -> None:
             pass
     elif transcript_path:
         tokens_input, tokens_output = _read_tokens_from_transcript(transcript_path, tool_use_id)
-        _post_usage(session_id, tool_name, tokens_input, tokens_output, None, blast_radius)
+        _post_usage(session_id, tool_name, tokens_input, tokens_output, None, blast_radius, execution_status, result_summary)
         _, action, rule_id, message = check_policy(tool_name, {}, tokens_before=tokens_input)
         if action in ("warn", "block"):
             decision = "warned" if action == "warn" else "blocked"

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/main.py

@@ -3238,6 +3238,7 @@ def main():
     verify_p.add_argument("--strict",    action="store_true",          help="Exit 1 if any blocked events in last 24h (CI mode).")
     verify_p.add_argument("--format",    choices=["text", "json"],     default="text", help="Output format (default: text)")
     verify_p.add_argument("--since",     default="24h",                help="Time window for blocked event check (e.g. 7d, 24h)")
+    verify_p.add_argument("--run",       action="store_true",          help="Fire live adversarial test battery and show per-test verdicts.")
     sub.add_parser("test-guard",            help="Fire a synthetic event per guard policy rule and show decisions")
     sub.add_parser("test-security",         help="Post a synthetic finding per security classifier pattern")
     sub.add_parser("test-security-verify",  help="Post test findings and verify full triage pipeline end-to-end")

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli/mcp_server.py

@@ -258,7 +258,15 @@ def _dispatch_tool(
     if name == "conduct_list_playbooks":
         return _handle_list_playbooks(server, workspace_id, token, api_key)
     if name == "conduct_run_workflow":
-        return _handle_run_workflow(arguments, server, workspace_id, token, api_key)
+        try:
+            from conduct_cli.hooks.pretooluse import check_policy
+            _, action, rule_id, message = check_policy("workflow", arguments)
+            if action == "block":
+                return json.dumps({"decision": "BLOCKED", "rule": rule_id, "message": f"[ConductGuard] {message}"})
+            warn_prefix = f"[ConductGuard] WARNING: {message}\n\n" if action == "warn" else ""
+        except Exception:
+            warn_prefix = ""
+        return warn_prefix + _handle_run_workflow(arguments, server, workspace_id, token, api_key)
     if name == "conduct_get_run":
         return _handle_get_run(arguments, server, token, api_key)
     if name == "conduct_guard_status":
@@ -308,6 +316,22 @@ def main() -> None:
                 "protocolVersion": PROTOCOL_VERSION,
                 "capabilities":    {"tools": {}},
                 "serverInfo":      {"name": "conduct", "version": "1.0.0"},
+                "instructions": (
+                    "ConductGuard is active and enforcing your team's security policy. "
+                    "ALWAYS call guard_activity at the start of every conversation with a "
+                    "one-line summary of what the user is asking you to do. "
+                    "ALWAYS call guard_check before executing any of the following: "
+                    "shell commands, file reads or writes, network requests, external API "
+                    "calls, code modifications, or any action that affects the filesystem "
+                    "or environment. "
+                    "If the response is BLOCKED: stop immediately and explain the policy "
+                    "rule to the user. "
+                    "If WARNING: proceed but surface the warning to the user. "
+                    "If ALLOWED: proceed normally. "
+                    "Use guard_status to show the user their current policy and team info. "
+                    "Use guard_sync after your security team updates policies. "
+                    "Never skip guard_activity or guard_check — both are required for compliance."
+                ),
             })
 
         elif method == "notifications/initialized":
@@ -319,8 +343,11 @@ def main() -> None:
         elif method == "tools/call":
             tool_name = params.get("name", "")
             arguments = params.get("arguments") or {}
-            text      = _dispatch_tool(tool_name, arguments, server, workspace_id, token, api_key)
-            _ok(msg_id, {"content": [{"type": "text", "text": text}]})
+            try:
+                text = _dispatch_tool(tool_name, arguments, server, workspace_id, token, api_key)
+                _ok(msg_id, {"content": [{"type": "text", "text": text}]})
+            except Exception as exc:
+                _ok(msg_id, {"content": [{"type": "text", "text": str(exc)}], "isError": True})
 
         elif method == "ping":
             _ok(msg_id, {})

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.34
+Version: 0.7.36
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.34 → conduct_cli-0.7.36}/src/conduct_cli.egg-info/SOURCES.txt

@@ -27,8 +27,10 @@ src/conduct_cli/hooks/session_report_push.py
 src/conduct_cli/hooks/session_start.py
 src/conduct_cli/hooks/stop.py
 tests/test_advisory_and_hook.py
+tests/test_api_client.py
 tests/test_bash_operator_signature.py
 tests/test_blast_radius.py
+tests/test_cmd_run.py
 tests/test_command_word_matcher.py
 tests/test_drain_daemon_health.py
 tests/test_guard_policy.py
@@ -39,4 +41,5 @@ tests/test_log_util.py
 tests/test_proxy_coverage.py
 tests/test_proxy_env.py
 tests/test_signed_policy.py
-tests/test_switch.py
+tests/test_switch.py
+tests/test_token_lifecycle.py