conduct-cli 0.7.46__tar.gz → 0.8.0__tar.gz

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.7.46
+Version: 0.8.0
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.7.46"
+version = "0.8.0"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/api.py

@@ -22,11 +22,9 @@ def _friendly(code: int, detail: str) -> str:
     return detail
 
 
-def headers(workspace_id: str, token=None, content_type="application/json", api_key=None) -> dict:
+def headers(workspace_id: str, token=None, content_type="application/json") -> dict:
     h = {"Content-Type": content_type, "X-Workspace-Id": workspace_id}
-    if api_key:
-        h["X-Api-Key"] = api_key
-    elif token:
+    if token:
         h["Authorization"] = f"Bearer {token}"
     return h
 

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/guard.py

@@ -276,11 +276,12 @@ _PERSONA_LABELS = {
 }
 
 
-def _ensure_persona(workspace_id: str, api_key: str, base_url: str) -> str:
+def _ensure_persona(workspace_id: str, base_url: str) -> str:
     """Prompt for persona if none is set yet. Saves choice to guard config and API.
 
     Returns the active persona name. Skips prompt silently if already set.
     """
+    agent_token = _default_agent_token() or ""
     cfg = _load_guard_config()
     if cfg.get("persona"):
         return cfg["persona"]
@@ -310,7 +311,7 @@ def _ensure_persona(workspace_id: str, api_key: str, base_url: str) -> str:
             "PATCH",
             f"{base_url}/guard/config/persona",
             body={"persona": chosen},
-            api_key=api_key,
+            token=agent_token or None,
         )
     except Exception:
         pass  # non-fatal — local config still records the choice
@@ -352,7 +353,7 @@ def _require_guard_config() -> dict:
     if not cfg or not ws:
         print(f"{RED}Guard not connected. Run: conduct login{RESET}", file=sys.stderr)
         sys.exit(0)
-    if not cfg.get("agent_token") and not cfg.get("api_key"):
+    if not cfg.get("agent_token"):
         print(f"{RED}Guard config is missing credentials. Run: conduct login{RESET}", file=sys.stderr)
         sys.exit(0)
     return cfg
@@ -474,40 +475,67 @@ def _patch_claude_desktop_proxy(api_url: str, agent_token: str) -> None:
 
 
 def _patch_copilot_mcp(agent_token: str, api_url: str) -> None:
-    """Keep ~/.copilot/mcp-config.json in sync with current agent token.
-
-    Copilot's mcp-config.json uses SSE + Bearer — it can't run a local stdio binary
-    the way Claude Code / Cursor can, so we write the SSE entry with a fresh token.
-    """
-    cfg_path = Path.home() / ".copilot" / "mcp-config.json"
-    if not cfg_path.exists():
-        return
-    try:
-        cfg = json.loads(cfg_path.read_text())
-    except (json.JSONDecodeError, OSError):
-        cfg = {}
-    mcp = cfg.setdefault("mcpServers", {})
-    entry = {
+    """Keep ~/.copilot/mcp-config.json and any .mcp.json in cwd in sync with current agent token."""
+    import shutil
+    sse_entry = {
         "type": "sse",
         "url": f"{api_url}/guard/mcp",
         "headers": {"Authorization": f"Bearer {agent_token}"},
         "tools": ["**"],
     }
-    if mcp.get("conduct-guard") == entry:
-        print(f"  {GRAY}conduct-guard MCP already registered in GitHub Copilot{RESET}")
-        return
-    mcp["conduct-guard"] = entry
-    cfg_path.write_text(json.dumps(cfg, indent=2))
-    print(f"  {GREEN}conduct-guard MCP registered in GitHub Copilot (SSE){RESET}")
+    booster_entry = {"command": "booster", "args": ["serve"]} if shutil.which("booster") else None
+
+    # ~/.copilot/mcp-config.json (global Copilot config)
+    global_path = Path.home() / ".copilot" / "mcp-config.json"
+    if global_path.exists():
+        _write_mcp_file(global_path, "conduct-guard", sse_entry, booster_entry, "GitHub Copilot (global)")
+
+    # .mcp.json in cwd (project-level, picked up by VS Code Copilot)
+    local_path = Path.cwd() / ".mcp.json"
+    if local_path.exists():
+        _write_mcp_file(local_path, "conduct-guard", sse_entry, booster_entry, "GitHub Copilot (.mcp.json)")
+
+
+def _write_mcp_file(
+    cfg_path: Path,
+    guard_key: str,
+    sse_entry: dict,
+    booster_entry: dict | None,
+    label: str,
+) -> None:
+    try:
+        cfg = json.loads(cfg_path.read_text())
+    except (json.JSONDecodeError, OSError):
+        cfg = {}
+    mcp = cfg.setdefault("mcpServers", {})
+    changed = False
+    if mcp.get(guard_key) != sse_entry:
+        mcp[guard_key] = sse_entry
+        changed = True
+        print(f"  {GREEN}conduct-guard MCP registered in {label}{RESET}")
+    else:
+        print(f"  {GRAY}conduct-guard MCP already registered in {label}{RESET}")
+    if booster_entry and mcp.get("agent-booster") != booster_entry:
+        mcp["agent-booster"] = booster_entry
+        changed = True
+    if changed:
+        cfg_path.write_text(json.dumps(cfg, indent=2))
 
 
 _GUARD_RULES_TEXT = (
+    "## ConductGuard — AI Governance Policy\n\n"
+    "A ConductGuard MCP server is connected to this session (server name: `conduct-guard`).\n"
+    "All Guard policies are enforced through it. You MUST follow these rules:\n\n"
     "Before executing any shell command, file write, network request, API call, or code change:\n"
-    "- Call guard_check (conductguard MCP tool) with the action and parameters.\n"
-    "- If BLOCKED: stop immediately and explain the policy rule to the user.\n"
-    "- If WARNING: proceed but surface the warning. If ALLOWED: proceed normally.\n"
-    "- Never write credentials, API keys, or secrets to files or output.\n"
-    "- Never send PII (emails, names, payment data) to external endpoints."
+    "1. Call the `guard_check` tool from the `conduct-guard` MCP server with the action and parameters.\n"
+    "2. If the response is BLOCKED: stop immediately and explain the policy rule to the user. Do not proceed.\n"
+    "3. If the response is WARNING: proceed but surface the warning message to the user.\n"
+    "4. If the response is ALLOWED: proceed normally.\n\n"
+    "Always-on rules (no guard_check needed, enforce unconditionally):\n"
+    "- Never write credentials, API keys, tokens, or secrets to any file or output.\n"
+    "- Never send PII (emails, names, payment data) to external endpoints.\n\n"
+    "Use `guard_status` (conduct-guard MCP) to show the user their current policy and team info.\n"
+    "Use `guard_activity` at the start of every session with a one-line summary of what you are doing."
 )
 
 
@@ -562,22 +590,10 @@ def _patch_tool_instruction_files(agent_token: str, api_url: str, dry_run: bool
     MARKER_END   = "<!-- /ConductGuard -->"
     GUARD_RULES  = _GUARD_RULES_TEXT
 
-    # Pull team instructions from API (non-fatal)
-    # Only write if admin has explicitly published (version != "v0")
-    team_content = ""
-    try:
-        resp = _req("GET", f"{api_url}/team-os/instructions", token=agent_token)
-        if (resp.get("version") or "v0") != "v0":
-            team_content = (resp.get("content") or "").strip()
-    except Exception:
-        pass
-
-    parts = [MARKER_START, "## ConductGuard Policy"]
-    if team_content:
-        parts.append(team_content)
-    parts.append(GUARD_RULES)
-    parts.append(MARKER_END)
-    guard_block = "\n".join(parts)
+    # Guard-only for now — team-os instructions are hidden pending redesign.
+    # This block just ensures every AI tool knows to invoke Guard via hooks
+    # or the conduct-guard MCP before taking action.
+    guard_block = "\n".join([MARKER_START, "## ConductGuard Policy", GUARD_RULES, MARKER_END])
 
     repo_root: Path | None = None
     for parent in [Path.cwd(), *Path.cwd().parents]:
@@ -731,12 +747,26 @@ def _install_codex_hook(hook_path: Path) -> None:
 
 # ── HTTP helpers (no third-party deps — mirrors api.py style) ─────────────────
 
-def _req(method: str, url: str, body=None, token: str = None, api_key: str = None, timeout: int = 20) -> dict:
+def _default_agent_token() -> str | None:
+    """Read the agent_token minted by `conduct login` from ~/.conduct/config.json.
+    This is the CLI's single canonical credential — every call to the central
+    API should carry it via Authorization: Bearer."""
+    try:
+        cfg_path = Path.home() / ".conduct" / "config.json"
+        if cfg_path.exists():
+            return json.loads(cfg_path.read_text()).get("agent_token") or None
+    except Exception:
+        pass
+    return None
+
+
+def _req(method: str, url: str, body=None, token: str = None, timeout: int = 20) -> dict:
+    # If no explicit token passed, fall back to the login-minted agent_token.
+    if not token:
+        token = _default_agent_token()
     headers = {"Content-Type": "application/json"}
     if token:
         headers["Authorization"] = f"Bearer {token}"
-    if api_key:
-        headers["X-Api-Key"] = api_key
     data = json.dumps(body).encode() if body is not None else None
     r = urllib.request.Request(url, data=data, headers=headers, method=method)
     try:
@@ -872,10 +902,10 @@ def _install_claude_hook(hook_path: Path) -> None:
 
 def cmd_guard_install(args):
     """Called automatically from `conduct login`. Sets up Guard: downloads policies, installs hook + MCP."""
-    api_key = getattr(args, "api_key", None)
-    server  = (getattr(args, "server", None) or "https://api.conductai.ai").rstrip("/")
+    agent_token = getattr(args, "agent_token", None)
+    server      = (getattr(args, "server", None) or "https://api.conductai.ai").rstrip("/")
 
-    # Load workspace_id from ~/.conduct/config.json
+    # Load workspace_id (and fallback agent_token) from ~/.conduct/config.json
     conduct_cfg_path = Path.home() / ".conduct" / "config.json"
     conduct_cfg: dict = {}
     if conduct_cfg_path.exists():
@@ -885,7 +915,9 @@ def cmd_guard_install(args):
             pass
 
     workspace_id = conduct_cfg.get("workspace")
-    if not workspace_id or not api_key:
+    if not agent_token:
+        agent_token = conduct_cfg.get("agent_token")
+    if not workspace_id or not agent_token:
         return  # nothing to do
 
     print(f"  Setting up Guard…")
@@ -893,16 +925,16 @@ def cmd_guard_install(args):
     result = _req(
         "GET",
         f"{server}/guard/config/installed?workspace_id={workspace_id}",
-        api_key=api_key,
+        token=agent_token or None,
     )
 
     if not result.get("installed"):
         print(f"  {GRAY}Guard not installed for this workspace — skipping{RESET}")
         return
 
-    agent_token    = result.get("agent_token") or ""
-    user_email     = result.get("user_email") or ""
-    clerk_user_id  = result.get("clerk_user_id") or ""
+    resp_agent_token = result.get("agent_token") or agent_token
+    user_email       = result.get("user_email") or ""
+    clerk_user_id    = result.get("clerk_user_id") or ""
 
     # Persona selection — prompt once, skip if already chosen
 
@@ -910,10 +942,9 @@ def cmd_guard_install(args):
     import time as _time
     _save_guard_config({
         "workspace_id":          workspace_id,
-        "agent_token":           agent_token,
+        "agent_token":           resp_agent_token,
         "user_email":            user_email,
         "clerk_user_id":         clerk_user_id,
-        "api_key":               api_key,
         "api_url":               server,
         "last_synced_at":        _time.time(),
     })
@@ -1084,7 +1115,7 @@ def _detect_ai_tools() -> list[dict]:
     def _check_json_mcp(path: Path) -> bool:
         try:
             d = json.loads(path.read_text()) if path.exists() else {}
-            return "conduct" in d.get("mcpServers", {})
+            return any("conduct" in k for k in d.get("mcpServers", {}))
         except Exception:
             return False
 
@@ -1191,7 +1222,7 @@ def _detect_ai_tools() -> list[dict]:
         vscode_settings = next((p for p in vscode_candidates if p.exists()), None)
         try:
             d = json.loads(vscode_settings.read_text()) if vscode_settings else {}
-            mcp_reg = "conduct" in d.get("mcp", {}).get("servers", {})
+            mcp_reg = any("conduct" in k for k in d.get("mcp", {}).get("servers", {}))
         except Exception:
             mcp_reg = False
         # Also check ~/.copilot/mcp-config.json (SSE entry written by guard sync)
@@ -1223,24 +1254,20 @@ def _report_tools_to_server() -> None:
         base_url = _api_url(cfg)
         email = cfg.get("user_email", "")
         token = cfg.get("agent_token", "")
-        api_key = cfg.get("api_key", "")
-
         if not email:
             return
-
-        # Also pull conduct API key for X-Api-Key auth (member_token is not accepted by this endpoint)
         conduct_cfg_path = Path.home() / ".conduct" / "config.json"
-        conduct_api_key = ""
+        conduct_agent_token = ""
         if conduct_cfg_path.exists():
             try:
-                conduct_api_key = json.loads(conduct_cfg_path.read_text()).get("api_key", "")
+                conduct_agent_token = json.loads(conduct_cfg_path.read_text()).get("agent_token", "")
             except Exception:
                 pass
 
         payload = json.dumps({"email": email, "tools": tools}).encode()
         headers = {"Content-Type": "application/json"}
-        if conduct_api_key and conduct_api_key.startswith("cond_live_"):
-            headers["X-Api-Key"] = conduct_api_key
+        if conduct_agent_token and conduct_agent_token.startswith("cond_live_"):
+            headers["Authorization"] = f"Bearer {conduct_agent_token}"
         elif token:
             headers["Authorization"] = f"Bearer {token}"
         req = urllib.request.Request(
@@ -1445,14 +1472,6 @@ def cmd_guard_sync(args):
     except Exception as e:
         print(f"  {YELLOW}Warning: could not refresh token ({e}) — using cached value{RESET}")
 
-    # Fetch team instructions version so session-start hook can detect staleness
-    try:
-        ver_resp = _req("GET", f"{base_url}/team-os/instructions/version", token=_token)
-        if ver_resp.get("version"):
-            _save_guard_config({"instructions_version": ver_resp["version"]})
-    except Exception:
-        pass  # non-fatal
-
     # Write LLM proxy env vars so any AI tool (Claude Code, Cursor, Codex, …)
     # routes through Conduct Guard. Customer-overridable via --proxy-url or
     # CONDUCT_PROXY_URL env var; otherwise fetched from server (workspace_config).
@@ -1848,7 +1867,7 @@ def _ensure_booster(root: Path) -> None:
             pass
 
 
-def _report_savings(cfg: dict, base_url: str, api_key: str = "") -> None:
+def _report_savings(cfg: dict, base_url: str, agent_token: str = "") -> None:
     import subprocess
 
     rtk_data = {}
@@ -1909,12 +1928,10 @@ def _report_savings(cfg: dict, base_url: str, api_key: str = "") -> None:
     }
 
     try:
-        agent_token_evt = cfg.get("agent_token", "")
+        agent_token_evt = cfg.get("agent_token", "") or agent_token
         headers = {"Content-Type": "application/json"}
         if agent_token_evt:
             headers["Authorization"] = f"Bearer {agent_token_evt}"
-        elif api_key:
-            headers["X-Api-Key"] = api_key
         data = json.dumps(payload).encode()
         req = urllib.request.Request(
             f"{base_url}/guard/savings",
@@ -1943,13 +1960,13 @@ def cmd_guard_status(args):
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
     user_email   = cfg.get("user_email", "")
-    api_key      = cfg.get("api_key", "")
+    agent_token  = cfg.get("agent_token", "")
     base_url     = _api_url(cfg)
 
     # Auto-refresh user_email + clerk_user_id into config if missing
-    if (not user_email or not cfg.get("clerk_user_id")) and api_key:
+    if (not user_email or not cfg.get("clerk_user_id")) and agent_token:
         try:
-            installed = _req("GET", f"{base_url}/guard/config/installed", api_key=api_key)
+            installed = _req("GET", f"{base_url}/guard/config/installed", token=agent_token or None)
             fetched_email = installed.get("user_email") or ""
             fetched_clerk = installed.get("clerk_user_id") or ""
             if fetched_email:
@@ -1973,7 +1990,7 @@ def cmd_guard_status(args):
         spend = _req(
             "GET",
             f"{base_url}/guard/spend?workspace_id={workspace_id}",
-            api_key=api_key,
+            token=agent_token or None,
         )
     except SystemExit:
         pass
@@ -1993,7 +2010,7 @@ def cmd_guard_status(args):
                 f"&since={today_iso}"
                 f"&limit=20"
             ),
-            api_key=api_key,
+            token=agent_token or None,
         )
         if not isinstance(events, list):
             events = events.get("events", [])
@@ -2074,14 +2091,14 @@ def cmd_guard_status(args):
 def cmd_guard_savings(args):
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
-    api_key      = cfg.get("api_key", "")
+    agent_token  = cfg.get("agent_token", "")
     base_url     = _api_url(cfg)
 
     try:
         data = _req(
             "GET",
             f"{base_url}/guard/savings/team-summary?workspace_id={workspace_id}",
-            api_key=api_key,
+            token=agent_token or None,
         )
     except Exception:
         print(f"{RED}Failed to fetch team savings.{RESET}")
@@ -2141,7 +2158,7 @@ def cmd_guard_audit(args):
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
     user_email   = cfg.get("user_email", "")
-    api_key      = cfg.get("api_key", "")
+    agent_token  = cfg.get("agent_token", "")
     base_url     = _api_url(cfg)
 
     since_str = getattr(args, "since", None) or "24h"
@@ -2156,7 +2173,7 @@ def cmd_guard_audit(args):
             f"&since={since_iso}"
             f"&limit=50"
         ),
-        api_key=api_key,
+        token=agent_token or None,
     )
     events = events_resp if isinstance(events_resp, list) else events_resp.get("events", [])
 
@@ -2321,7 +2338,7 @@ def _discover_config_agents() -> list[tuple]:
                 return "conduct" in text and "mcp_servers" in text
             import json as _j
             d = _j.loads(text)
-            return "conduct" in d.get("mcpServers", {})
+            return any("conduct" in k for k in d.get("mcpServers", {}))
         except Exception:
             return False
 
@@ -2347,6 +2364,7 @@ def _discover_config_agents() -> list[tuple]:
         ("codex",       home / ".codex",   home / ".codex"   / "config.toml",    "mcp"),
         ("cursor",      home / ".cursor",  home / ".cursor"  / "mcp.json",       "mcp"),
         ("windsurf",    home / ".codeium" / "windsurf", home / ".codeium" / "windsurf" / "mcp_config.json", "mcp"),
+        ("copilot",     home / ".copilot", home / ".copilot" / "mcp-config.json", "mcp"),
     ]
     for name, check_dir, config_path, _ in TOOLS:
         if check_dir.exists():
@@ -2465,7 +2483,7 @@ def _watch_loop():
             c       = _cfg()
             api_url = _api_url(c)
             token   = c.get("agent_token", "")
-            api_key = c.get("api_key", "")
+            agent_token = c.get("agent_token", "")
             agents = []
             for name, config_path, mcp_key in _discover_config_agents():
                 agents.append({
@@ -2485,7 +2503,7 @@ def _watch_loop():
                 pass
             _req("POST", f"{api_url}/guard/discover/scan",
                  body={"triggered_by": "watch", "agents": agents},
-                 token=token, api_key=api_key)
+                 token=token or agent_token)
         except Exception:
             pass
         time.sleep(_WATCH_INTERVAL)
@@ -2641,7 +2659,6 @@ def cmd_guard_discover(args):
     cfg      = _load_guard_config()
     api_url  = _api_url(cfg)
     token    = cfg.get("agent_token", "")
-    api_key  = cfg.get("api_key", "")
     hdrs     = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
 
     # Config file scan — detect AI tools from known config dirs
@@ -2701,7 +2718,7 @@ def cmd_guard_discover(args):
                 "proxy_routed": t.get("proxy_routed", False),
             })
         payload = {"triggered_by": "cli", "agents": agents_payload}
-        _req("POST", f"{api_url}/guard/discover/scan", body=payload, token=token, api_key=api_key)
+        _req("POST", f"{api_url}/guard/discover/scan", body=payload, token=token)
     except SystemExit:
         pass  # 401/network errors — local output still useful
 
@@ -2915,14 +2932,14 @@ def cmd_verify(args) -> None:
 
     cfg          = _require_guard_config()
     workspace_id = cfg.get("workspace_id")
-    api_key      = cfg.get("api_key", "")
+    agent_token  = cfg.get("agent_token", "")
     base_url     = _api_url(cfg)
 
     # ── fetch evidence from API ───────────────────────────────────────────────
     ev = _req(
         "GET",
         f"{base_url}/guard/verify/evidence?workspace_id={workspace_id}",
-        api_key=api_key,
+        token=agent_token or None,
     )
 
     grade        = ev.get("grade", "F")
@@ -2939,7 +2956,7 @@ def cmd_verify(args) -> None:
         run_result = _req(
             "POST",
             f"{base_url}/guard/verify/run?workspace_id={workspace_id}",
-            api_key=api_key,
+            token=agent_token or None,
         )
         if fmt == "json":
             print(_json.dumps(run_result, indent=2))

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/base.py

@@ -148,14 +148,14 @@ def _refresh_policy_from_api() -> None:
     try:
         cfg = load_config()
         workspace_id = cfg.get("workspace_id")
-        api_key = cfg.get("api_key", "")
+        agent_token = cfg.get("agent_token", "")
         api_url = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
-        if not api_key:
+        if not agent_token:
             return
         url = f"{api_url}/guard/policies/sync"
         if workspace_id:
             url += f"?workspace_id={workspace_id}"
-        req = urllib.request.Request(url, headers={"X-Api-Key": api_key})
+        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {agent_token}"})
         with urllib.request.urlopen(req, timeout=8) as resp:
             data = resp.read()
         POLICY_PATH.parent.mkdir(parents=True, exist_ok=True)

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/posttooluse.py

@@ -92,7 +92,7 @@ def _maybe_emit_security_finding(tool_response, session_id, tool_name, tool_inpu
     if not cfg.get("security_emit_enabled", False):
         return
     workspace_id = cfg.get("workspace_id")
-    api_key      = cfg.get("api_key", "")
+    agent_token = cfg.get("agent_token", "")
     api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
     if not workspace_id:
         return
@@ -138,7 +138,7 @@ def _maybe_emit_security_finding(tool_response, session_id, tool_name, tool_inpu
         "try:\n"
         f"    req = urllib.request.Request(\"{api_url}/security-findings?workspace_id={workspace_id}\","
         f" data={repr(payload.encode())}, headers={{\"Content-Type\": \"application/json\","
-        f" \"X-Api-Key\": \"{api_key}\"}}, method=\"POST\")\n"
+        f" \"Authorization\": \"Bearer {agent_token}\"}}, method=\"POST\")\n"
         "    urllib.request.urlopen(req, timeout=5)\n"
         "except: pass\n"
     )

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/pretooluse.py

@@ -156,7 +156,7 @@ def _maybe_sync_policy() -> None:
     try:
         cfg = load_config()
         workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
-        api_key      = cfg.get("agent_token") or cfg.get("api_key", "")
+        agent_token  = cfg.get("agent_token", "")
         api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
         if not workspace_id:
             return
@@ -175,7 +175,7 @@ def _maybe_sync_policy() -> None:
             if time.time() - cache.get("ts", 0) < VERSION_CACHE_TTL:
                 return
         url = f"{api_url}/guard/policies/sync?workspace_id={workspace_id}"
-        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {api_key}"} if api_key else {})
+        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {agent_token}"} if agent_token else {})
         with urllib.request.urlopen(req, timeout=2) as resp:
             remote = json.loads(resp.read())
 

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/session_report_push.py

@@ -33,7 +33,7 @@ def _load_config() -> dict:
 def run(session_id: str = "") -> None:
     cfg = _load_config()
     server = (cfg.get("api_url") or cfg.get("server") or "https://api.conductai.ai").rstrip("/")
-    api_key = cfg.get("api_key", "")
+    agent_token = cfg.get("agent_token", "")
     member_token = cfg.get("member_token", "")
     workspace_id = cfg.get("workspace_id", "")
 
@@ -115,8 +115,8 @@ def run(session_id: str = "") -> None:
         }
         if member_token:
             headers["Authorization"] = f"Bearer {member_token}"
-        elif api_key:
-            headers["X-API-Key"] = api_key
+        elif agent_token:
+            headers["Authorization"] = f"Bearer {agent_token}"
 
         req = urllib.request.Request(
             f"{server}/guard/session-reports",

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/session_start.py

@@ -124,7 +124,7 @@ def _backfill_prev_session(current_session_id: str, cwd: str | None) -> None:
             return
         cfg = json.loads(cfg_path.read_text())
         server = cfg.get("server", "").rstrip("/")
-        api_key = cfg.get("api_key", "")
+        agent_token = cfg.get("agent_token", "")
         workspace_id = cfg.get("workspace_id") or cfg.get("workspace", "")
         if not server:
             return
@@ -145,7 +145,7 @@ def _backfill_prev_session(current_session_id: str, cwd: str | None) -> None:
                     data=payload,
                     headers={
                         "Content-Type": "application/json",
-                        "X-API-Key": api_key,
+                        "Authorization": f"Bearer {agent_token}",
                         "X-Workspace-ID": workspace_id,
                     },
                     method="PATCH",

{conduct_cli-0.7.46 → conduct_cli-0.8.0}/src/conduct_cli/hooks/stop.py

@@ -26,7 +26,7 @@ def _post_intent(session_id: str, ai_tool: str, cwd: str | None) -> None:
             return
         cfg = _json.loads(cfg_path.read_text())
         server = cfg.get("server", "").rstrip("/")
-        api_key = cfg.get("api_key", "")
+        agent_token = cfg.get("agent_token", "")
         workspace_id = cfg.get("workspace_id") or cfg.get("workspace", "")
         if not server or not session_id:
             return
@@ -43,7 +43,7 @@ def _post_intent(session_id: str, ai_tool: str, cwd: str | None) -> None:
             data=payload,
             headers={
                 "Content-Type": "application/json",
-                "X-API-Key": api_key,
+                "Authorization": f"Bearer {agent_token}",
                 "X-Workspace-ID": workspace_id,
             },
             method="PATCH",