conduct-cli 0.7.44__tar.gz → 0.7.46__tar.gz

{conduct_cli-0.7.44 → conduct_cli-0.7.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.44
+Version: 0.7.46
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.44 → conduct_cli-0.7.46}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.44"
+version = "0.7.46"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.44 → conduct_cli-0.7.46}/src/conduct_cli/guard.py

@@ -388,7 +388,7 @@ _MCP_TARGETS = [
 ]
 
 
-def _register_mcp(workspace_id: str, agent_token: str, api_url: str) -> None:
+def _register_mcp(workspace_id: str, agent_token: str, api_url: str, dry_run: bool = False) -> None:
     """Write conductguard + agent-booster MCP entries into every AI tool config found.
 
     Credentials are NOT stored in the MCP config — the server reads them from
@@ -441,7 +441,7 @@ def _register_mcp(workspace_id: str, agent_token: str, api_url: str) -> None:
 
     # Cursor global rules — write Guard policies as user rules so they apply across all projects.
     _patch_cursor_global_rules()
-    _patch_tool_instruction_files(agent_token, api_url)
+    _patch_tool_instruction_files(agent_token, api_url, dry_run=dry_run)
 
 
 def _patch_claude_desktop_proxy(api_url: str, agent_token: str) -> None:
@@ -542,7 +542,7 @@ def _patch_cursor_global_rules() -> None:
         print(f"  {GREEN}Cursor global rules updated with ConductGuard policy{RESET}")
 
 
-def _patch_tool_instruction_files(agent_token: str, api_url: str) -> None:
+def _patch_tool_instruction_files(agent_token: str, api_url: str, dry_run: bool = False) -> None:
     """Write ConductGuard policy block into instruction files for all AI tools.
 
     Targets:
@@ -563,10 +563,12 @@ def _patch_tool_instruction_files(agent_token: str, api_url: str) -> None:
     GUARD_RULES  = _GUARD_RULES_TEXT
 
     # Pull team instructions from API (non-fatal)
+    # Only write if admin has explicitly published (version != "v0")
     team_content = ""
     try:
         resp = _req("GET", f"{api_url}/team-os/instructions", token=agent_token)
-        team_content = (resp.get("content") or "").strip()
+        if (resp.get("version") or "v0") != "v0":
+            team_content = (resp.get("content") or "").strip()
     except Exception:
         pass
 
@@ -597,19 +599,64 @@ def _patch_tool_instruction_files(agent_token: str, api_url: str) -> None:
         path = repo_path if (repo_path and repo_path.exists()) else global_path
         if not path.exists() and repo_path:
             path = repo_path
-        path.parent.mkdir(parents=True, exist_ok=True)
         existing = path.read_text() if path.exists() else ""
         if MARKER_START in existing:
             updated = pattern.sub(guard_block, existing)
-            if updated == existing:
-                print(f"  {GRAY}{label} already up to date{RESET}")
+            if dry_run:
+                if updated == existing:
+                    print(f"  [dry-run] No change: {path}")
+                else:
+                    print(f"  [dry-run] Would write: {path}")
             else:
-                path.write_text(updated)
-                print(f"  {GREEN}{label} updated{RESET}")
+                path.parent.mkdir(parents=True, exist_ok=True)
+                if updated == existing:
+                    print(f"  {GRAY}{label} already up to date{RESET}")
+                else:
+                    path.write_text(updated)
+                    print(f"  {GREEN}{label} updated{RESET}")
         else:
-            sep = "\n\n" if existing.strip() else ""
-            path.write_text((existing.rstrip() + sep + guard_block + "\n").lstrip())
-            print(f"  {GREEN}{label} — ConductGuard block added{RESET}")
+            new_content = (existing.rstrip() + ("\n\n" if existing.strip() else "") + guard_block + "\n").lstrip()
+            if dry_run:
+                if new_content == existing:
+                    print(f"  [dry-run] No change: {path}")
+                else:
+                    print(f"  [dry-run] Would write: {path}")
+            else:
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_text(new_content)
+                print(f"  {GREEN}{label} — ConductGuard block added{RESET}")
+
+
+def _reset_tool_instruction_files() -> None:
+    """Remove ConductGuard blocks from all instruction files."""
+    import re as _re
+    MARKER_RE = _re.compile(
+        r"\n?<!-- ConductGuard -->\n.*?<!-- /ConductGuard -->\n?",
+        _re.DOTALL,
+    )
+    targets = [
+        Path.home() / "CLAUDE.md",
+        Path.cwd() / "CLAUDE.md",
+        Path.cwd() / ".github" / "copilot-instructions.md",
+        Path.cwd() / "AGENTS.md",
+        Path.cwd() / ".cursorrules",
+        Path.cwd() / ".windsurfrules",
+    ]
+    removed = 0
+    for p in targets:
+        if not p.exists():
+            continue
+        original = p.read_text(encoding="utf-8")
+        cleaned = MARKER_RE.sub("", original).strip()
+        if cleaned != original.strip():
+            p.write_text(cleaned + "\n", encoding="utf-8")
+            print(f"  {GREEN}Removed ConductGuard block: {p}{RESET}")
+            removed += 1
+        else:
+            print(f"  {YELLOW}No ConductGuard block found: {p}{RESET}")
+    if removed == 0:
+        print("  No ConductGuard blocks found in any instruction files.")
+
 
 def _install_codex_hook(hook_path: Path) -> None:
     """Register PreToolUse and PostToolUse hooks in ~/.codex/hooks.json."""
@@ -1319,6 +1366,12 @@ def cmd_guard_sync(args):
     # Persona selection — prompt once, skip if already chosen
 
     dry_run = getattr(args, "dry_run", False)
+
+    if getattr(args, "reset_instructions", False):
+        print("Removing ConductGuard blocks from instruction files…")
+        _reset_tool_instruction_files()
+        return
+
     print(f"{'[dry-run] ' if dry_run else ''}Syncing policy…")
     _check_and_upgrade_packages()
 
@@ -1463,7 +1516,7 @@ def cmd_guard_sync(args):
     _install_claude_hook(hook_path)
     _install_codex_hook(hook_path)
     cfg2 = _load_guard_config()
-    _register_mcp(workspace_id, cfg2.get("agent_token", ""), base_url)
+    _register_mcp(workspace_id, cfg2.get("agent_token", ""), base_url, dry_run=dry_run)
     try:
         _install_session_hooks()
     except Exception:
@@ -2176,6 +2229,8 @@ def register_guard_parser(sub):
     sync_p = guard_sub.add_parser("sync", help="Refresh policy and re-scan for AI tools")
     sync_p.add_argument("--cursor", action="store_true", help="Write active Guard policies to .cursorrules")
     sync_p.add_argument("--dry-run", action="store_true", help="Preview policy changes without writing anything")
+    sync_p.add_argument("--reset-instructions", action="store_true", dest="reset_instructions",
+                        help="Remove ConductGuard blocks from all instruction files")
     sync_p.add_argument("--proxy-url", default=None,
                         help="Override the Guard proxy URL (default: https://api.conductai.ai/proxy/anthropic)")
     sync_p.add_argument("--no-local-audit", action="store_true",

{conduct_cli-0.7.44 → conduct_cli-0.7.46}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.44
+Version: 0.7.46
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.44 → conduct_cli-0.7.46}/src/conduct_cli.egg-info/SOURCES.txt

@@ -36,6 +36,7 @@ tests/test_drain_daemon_health.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py
 tests/test_hook_dispatch.py
+tests/test_instruction_files.py
 tests/test_journal_drain.py
 tests/test_log_util.py
 tests/test_proxy_coverage.py

conduct_cli-0.7.46/tests/test_instruction_files.py

@@ -0,0 +1,263 @@
+"""
+Tests for AI Rollout (epic #961) — CLI instruction file management.
+
+Covers:
+  - _patch_tool_instruction_files: new file, idempotent re-sync, dry_run, existing content preserved
+  - _reset_tool_instruction_files: strips markers, preserves surrounding content
+  - _check_instructions_staleness: stale version, up-to-date, no local version
+"""
+from __future__ import annotations
+
+import json
+import sys
+from io import BytesIO
+from pathlib import Path
+from unittest.mock import MagicMock, patch, call
+
+import pytest
+
+# ── ensure conduct_cli is importable ─────────────────────────────────────────
+CONDUCT_CLI_SRC = Path(__file__).resolve().parent.parent / "src"
+if str(CONDUCT_CLI_SRC) not in sys.path:
+    sys.path.insert(0, str(CONDUCT_CLI_SRC))
+
+import conduct_cli.guard as guard_mod
+from conduct_cli.guard import _patch_tool_instruction_files, _reset_tool_instruction_files
+
+MARKER_START = "<!-- ConductGuard — managed by conduct guard sync -->"
+MARKER_END   = "<!-- /ConductGuard -->"
+
+# Five target filenames relative to repo root
+_TARGET_NAMES = [
+    "CLAUDE.md",
+    ".github/copilot-instructions.md",
+    "AGENTS.md",
+    ".cursorrules",
+    ".windsurfrules",
+]
+
+
+def _make_api_response(content: str = "# team rules\n", version: str = "v1") -> MagicMock:
+    """Return a mock urllib response yielding the given JSON payload."""
+    payload = json.dumps({"content": content, "version": version}).encode()
+    mock_resp = MagicMock()
+    mock_resp.read.return_value = payload
+    mock_resp.__enter__ = lambda s: s
+    mock_resp.__exit__ = MagicMock(return_value=False)
+    return mock_resp
+
+
+def _redirect_cwd_and_home(tmp_path: Path, monkeypatch) -> Path:
+    """
+    Point Path.cwd() and Path.home() at tmp_path sub-dirs.
+    Also create a fake .git so _patch_tool_instruction_files finds a repo_root.
+    Returns the repo root path.
+    """
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    (repo / ".git").mkdir()
+
+    home = tmp_path / "home"
+    home.mkdir()
+
+    monkeypatch.chdir(repo)
+    monkeypatch.setattr(Path, "home", staticmethod(lambda: home))
+    return repo
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 1. New file created — all 5 targets get marker block
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_patch_creates_new_files_with_marker_block(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    mock_resp = _make_api_response("# team rules\n", "v1")
+    with patch("conduct_cli.guard.urllib.request.urlopen", return_value=mock_resp):
+        _patch_tool_instruction_files(
+            agent_token="tok-123",
+            api_url="https://api.conductai.ai",
+            dry_run=False,
+        )
+
+    for rel in _TARGET_NAMES:
+        p = repo / rel
+        assert p.exists(), f"Expected {rel} to be created"
+        text = p.read_text()
+        assert MARKER_START in text, f"{rel} missing marker start"
+        assert MARKER_END in text, f"{rel} missing marker end"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 2. Idempotent re-sync — marker block appears exactly once
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_patch_idempotent_resync(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    mock_resp = _make_api_response("# team rules\n", "v1")
+    with patch("conduct_cli.guard.urllib.request.urlopen", return_value=mock_resp):
+        _patch_tool_instruction_files("tok", "https://api.conductai.ai", dry_run=False)
+
+    mock_resp2 = _make_api_response("# team rules\n", "v1")
+    with patch("conduct_cli.guard.urllib.request.urlopen", return_value=mock_resp2):
+        _patch_tool_instruction_files("tok", "https://api.conductai.ai", dry_run=False)
+
+    for rel in _TARGET_NAMES:
+        p = repo / rel
+        text = p.read_text()
+        assert text.count(MARKER_START) == 1, f"{rel} should have exactly one marker block after two syncs"
+        assert text.count(MARKER_END) == 1, f"{rel} should have exactly one end marker"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 3. dry_run=True — no files written, something printed
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_patch_dry_run_does_not_write_files(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    mock_resp = _make_api_response("# team rules\n", "v1")
+    with patch("conduct_cli.guard.urllib.request.urlopen", return_value=mock_resp):
+        _patch_tool_instruction_files("tok", "https://api.conductai.ai", dry_run=True)
+
+    for rel in _TARGET_NAMES:
+        p = repo / rel
+        assert not p.exists(), f"{rel} should NOT be created in dry_run mode"
+
+    out = capsys.readouterr().out
+    assert out.strip(), "Expected at least some output in dry_run mode"
+    assert "[dry-run]" in out
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 4. Existing developer content preserved
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_patch_preserves_existing_developer_content(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    claude_md = repo / "CLAUDE.md"
+    claude_md.write_text("# My rules\nDo X\n")
+
+    mock_resp = _make_api_response("# team rules\n", "v1")
+    with patch("conduct_cli.guard.urllib.request.urlopen", return_value=mock_resp):
+        _patch_tool_instruction_files("tok", "https://api.conductai.ai", dry_run=False)
+
+    text = claude_md.read_text()
+    assert "# My rules" in text, "Original developer content should be preserved"
+    assert "Do X" in text, "Original developer content should be preserved"
+    assert MARKER_START in text, "Marker block should be appended"
+    assert MARKER_END in text, "Marker block end should be present"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 5. _reset_tool_instruction_files — strips markers, preserves surrounding content
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_reset_strips_marker_block_and_preserves_content(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    # _reset uses a slightly different marker format (without the long comment)
+    # Match what _reset_tool_instruction_files actually searches for
+    RESET_MARKER_START = "<!-- ConductGuard -->"
+    RESET_MARKER_END   = "<!-- /ConductGuard -->"
+    block = f"\n{RESET_MARKER_START}\n## Rules\nDo guard stuff.\n{RESET_MARKER_END}\n"
+
+    claude_md = repo / "CLAUDE.md"
+    claude_md.write_text(f"# Dev content\nKeep this.\n{block}\n# After block\n")
+
+    # _reset uses Path.cwd() directly for repo targets and Path.home() for home
+    _reset_tool_instruction_files()
+
+    text = claude_md.read_text()
+    assert RESET_MARKER_START not in text, "Marker start should be stripped"
+    assert RESET_MARKER_END not in text, "Marker end should be stripped"
+    assert "Keep this." in text, "Content before marker block must be preserved"
+
+
+def test_reset_no_marker_prints_notice(tmp_path, monkeypatch, capsys):
+    repo = _redirect_cwd_and_home(tmp_path, monkeypatch)
+
+    claude_md = repo / "CLAUDE.md"
+    claude_md.write_text("# No guard block here\n")
+
+    _reset_tool_instruction_files()
+
+    out = capsys.readouterr().out
+    assert "No ConductGuard block" in out or "No ConductGuard blocks" in out
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 6-8. _check_instructions_staleness
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Re-import from session_start
+SESSION_HOOK_SRC = CONDUCT_CLI_SRC
+if str(SESSION_HOOK_SRC) not in sys.path:
+    sys.path.insert(0, str(SESSION_HOOK_SRC))
+
+from conduct_cli.hooks.session_start import _check_instructions_staleness
+
+
+def _make_version_response(version: str) -> MagicMock:
+    payload = json.dumps({"version": version}).encode()
+    mock_resp = MagicMock()
+    mock_resp.read.return_value = payload
+    mock_resp.__enter__ = lambda s: s
+    mock_resp.__exit__ = MagicMock(return_value=False)
+    return mock_resp
+
+
+# 6. Stale: local v1, remote v2 → warning printed
+def test_staleness_check_stale_prints_warning(capsys):
+    cfg = {
+        "api_url": "https://api.conductai.ai",
+        "agent_token": "tok-abc",
+        "instructions_version": "v1",
+    }
+    remote_resp = _make_version_response("v2")
+
+    # urllib.request is imported inside the function body as a local alias (_req).
+    # Patch the canonical module so the alias resolves to our mock.
+    with patch("conduct_cli.hooks.session_start.load_config", return_value=cfg), \
+         patch("urllib.request.urlopen", return_value=remote_resp):
+        _check_instructions_staleness()
+
+    out = capsys.readouterr().out
+    assert "v1" in out and "v2" in out, "Warning should mention both versions"
+    assert "conduct guard sync" in out, "Warning should suggest running sync"
+
+
+# 7. Up to date: local v1, remote v1 → nothing printed
+def test_staleness_check_up_to_date_no_output(capsys):
+    cfg = {
+        "api_url": "https://api.conductai.ai",
+        "agent_token": "tok-abc",
+        "instructions_version": "v1",
+    }
+    remote_resp = _make_version_response("v1")
+
+    with patch("conduct_cli.hooks.session_start.load_config", return_value=cfg), \
+         patch("urllib.request.urlopen", return_value=remote_resp):
+        _check_instructions_staleness()
+
+    out = capsys.readouterr().out
+    assert out.strip() == "", f"Expected no output when up-to-date, got: {repr(out)}"
+
+
+# 8. No local version → returns silently without making HTTP call
+def test_staleness_check_no_local_version_silent(capsys):
+    cfg = {
+        "api_url": "https://api.conductai.ai",
+        "agent_token": "tok-abc",
+        # no instructions_version key
+    }
+
+    with patch("conduct_cli.hooks.session_start.load_config", return_value=cfg), \
+         patch("urllib.request.urlopen") as mock_open:
+        _check_instructions_staleness()
+
+    mock_open.assert_not_called()
+    out = capsys.readouterr().out
+    assert out.strip() == "", "Expected no output when no local version"