conduct-cli 0.7.40__tar.gz → 0.7.42__tar.gz

{conduct_cli-0.7.40 → conduct_cli-0.7.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.40
+Version: 0.7.42
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.40 → conduct_cli-0.7.42}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.40"
+version = "0.7.42"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.40 → conduct_cli-0.7.42}/src/conduct_cli/guard.py

@@ -441,6 +441,7 @@ def _register_mcp(workspace_id: str, agent_token: str, api_url: str) -> None:
 
     # Cursor global rules — write Guard policies as user rules so they apply across all projects.
     _patch_cursor_global_rules()
+    _patch_copilot_instructions()
 
 
 def _patch_claude_desktop_proxy(api_url: str, agent_token: str) -> None:
@@ -540,6 +541,60 @@ def _patch_cursor_global_rules() -> None:
         print(f"  {GREEN}Cursor global rules updated with ConductGuard policy{RESET}")
 
 
+def _patch_copilot_instructions() -> None:
+    """Write ConductGuard enforcement instructions into .github/copilot-instructions.md.
+
+    Copilot injects this file into every conversation automatically — soft hooks
+    for tools that don't support PreToolUse/PostToolUse interception.
+    Written to the current repo root if a .github/ dir exists, and to ~/
+    as a global fallback.
+    """
+    GUARD_BLOCK = (
+        "<!-- ConductGuard — managed by conduct guard sync, do not edit this block -->\n"
+        "## ConductGuard Policy\n"
+        "Before executing any shell command, file write, network request, API call, or code change:\n"
+        "- Call `guard_check` (conductguard MCP tool) with the action and parameters.\n"
+        "- If BLOCKED: stop immediately and explain the policy rule to the user.\n"
+        "- If WARNING: proceed but surface the warning.\n"
+        "- If ALLOWED: proceed normally.\n"
+        "Never write credentials, API keys, or secrets to files or output.\n"
+        "Never send PII (emails, names, payment data) to external endpoints.\n"
+        "<!-- /ConductGuard -->"
+    )
+
+    candidates: list[Path] = []
+    # Repo-level: walk up from cwd to find .github/
+    cwd = Path.cwd()
+    for parent in [cwd, *cwd.parents]:
+        gh = parent / ".github"
+        if gh.is_dir():
+            candidates.append(gh / "copilot-instructions.md")
+            break
+    # Global fallback
+    candidates.append(Path.home() / ".github" / "copilot-instructions.md")
+
+    wrote_any = False
+    for path in candidates:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        existing = path.read_text() if path.exists() else ""
+        if "<!-- ConductGuard" in existing:
+            print(f"  {GRAY}Copilot instructions already contain ConductGuard policy ({path}){RESET}")
+            wrote_any = True
+            continue
+        updated = (existing.rstrip() + "\n\n" + GUARD_BLOCK).lstrip()
+        path.write_text(updated)
+        print(f"  {GREEN}Copilot instructions updated with ConductGuard policy ({path}){RESET}")
+        wrote_any = True
+        break  # repo-level wins; skip global if repo found
+
+    if not wrote_any:
+        # No .github/ dir found anywhere — write global
+        global_path = Path.home() / ".github" / "copilot-instructions.md"
+        global_path.parent.mkdir(parents=True, exist_ok=True)
+        global_path.write_text(GUARD_BLOCK)
+        print(f"  {GREEN}Copilot instructions written ({global_path}){RESET}")
+
+
 def _install_codex_hook(hook_path: Path) -> None:
     """Register PreToolUse and PostToolUse hooks in ~/.codex/hooks.json."""
     codex_hooks = Path.home() / ".codex" / "hooks.json"
@@ -1321,6 +1376,14 @@ def cmd_guard_sync(args):
     except Exception as e:
         print(f"  {YELLOW}Warning: could not refresh token ({e}) — using cached value{RESET}")
 
+    # Fetch team instructions version so session-start hook can detect staleness
+    try:
+        ver_resp = _req("GET", f"{base_url}/team-os/instructions/version", token=_token)
+        if ver_resp.get("version"):
+            _save_guard_config({"instructions_version": ver_resp["version"]})
+    except Exception:
+        pass  # non-fatal
+
     # Write LLM proxy env vars so any AI tool (Claude Code, Cursor, Codex, …)
     # routes through Conduct Guard. Customer-overridable via --proxy-url or
     # CONDUCT_PROXY_URL env var; otherwise fetched from server (workspace_config).
@@ -1351,7 +1414,7 @@ def cmd_guard_sync(args):
         for t in _tools:
             routed = "✓ Routed" if t.get("proxy_routed") else ("— Partial" if t["name"] == "codex-desktop" else "✗ Not routed")
             mcp  = "✓" if t.get("mcp_registered") else "✗"
-            hook = "✓" if t.get("hook_registered") else "—"
+            hook = "✓" if t.get("hook_registered") else ("~ soft" if t["name"] in ("copilot", "cursor") else "—")
             print(f"  {t['name']:<20} {routed:<16} {mcp:<8} {hook}")
         print()
 

{conduct_cli-0.7.40 → conduct_cli-0.7.42}/src/conduct_cli/hooks/session_start.py

@@ -57,6 +57,34 @@ def _check_proxy_token() -> None:
         pass
 
 
+def _check_instructions_staleness() -> None:
+    """Warn if team AI instructions have been updated since last sync.
+
+    Reads local instructions_version from config, hits GET /team-os/instructions/version,
+    prints one-line warning if stale. Timeout 2s — never blocks the session.
+    """
+    try:
+        import urllib.request as _req
+        cfg = load_config()
+        api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
+        agent_token = cfg.get("agent_token", "")
+        local_version = cfg.get("instructions_version")
+        if not agent_token or not local_version:
+            return  # not synced yet — nothing to compare
+
+        request = _req.Request(
+            f"{api_url}/team-os/instructions/version",
+            headers={"Authorization": f"Bearer {agent_token}"},
+        )
+        with _req.urlopen(request, timeout=2) as resp:
+            data = json.loads(resp.read())
+        remote_version = data.get("version")
+        if remote_version and remote_version != local_version:
+            print(f"⚠  Team AI instructions updated ({local_version} → {remote_version}) — run `conduct guard sync` to pull latest\n")
+    except Exception:
+        pass  # always silent — session-start must never fail
+
+
 def _backfill_prev_session(current_session_id: str, cwd: str | None) -> None:
     """Parse + PATCH the most recent completed session (the one that just ended).
 
@@ -155,6 +183,7 @@ def main() -> None:
             pass
 
     _check_proxy_token()
+    _check_instructions_staleness()
 
     if not SNAPSHOT_PATH.exists():
         sys.exit(0)

{conduct_cli-0.7.40 → conduct_cli-0.7.42}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.40
+Version: 0.7.42
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT