conduct-cli 0.8.3__tar.gz → 0.8.5__tar.gz

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.8.3
+Version: 0.8.5
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -31,6 +31,8 @@ Requires-Dist: agent-booster[watch]>=0.6.6; extra == "booster"
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
 
+Runs on Linux, macOS, and Windows. Python 3.9–3.12.
+
 ![Conduct CLI demo — whoami, switch workspaces with Guard policy sync, and run an agent](assets/conduct-cli-demo.gif)
 
 ## Install
@@ -45,7 +47,7 @@ pip install conduct-cli
 # Authenticate (one-time)
 conduct login \
   --server https://api.conductai.ai \
-  --api-key cond_live_xxx \
+  --token cond_agt_xxx \
   --workspace <workspace-id>
 
 # Browse available agents
@@ -81,10 +83,10 @@ conduct test --all
 
 ## Authentication
 
-Generate an API key from **Settings → API Keys** in the Conduct AI dashboard. Keys start with `cond_live_` and are stored as SHA-256 hashes — the plaintext is shown only once.
+Generate an agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard. Tokens start with `cond_agt_` and are stored as SHA-256 hashes — the plaintext is shown only once.
 
 ```bash
-conduct login --server https://api.conductai.ai --api-key cond_live_xxx --workspace <id>
+conduct login --server https://api.conductai.ai --token cond_agt_xxx --workspace <id>
 ```
 
 ## Install all agents
@@ -313,7 +315,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 }
 ```
 
-Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard.
 
 ---
 

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/README.md

@@ -3,6 +3,8 @@
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
 
+Runs on Linux, macOS, and Windows. Python 3.9–3.12.
+
 ![Conduct CLI demo — whoami, switch workspaces with Guard policy sync, and run an agent](assets/conduct-cli-demo.gif)
 
 ## Install
@@ -17,7 +19,7 @@ pip install conduct-cli
 # Authenticate (one-time)
 conduct login \
   --server https://api.conductai.ai \
-  --api-key cond_live_xxx \
+  --token cond_agt_xxx \
   --workspace <workspace-id>
 
 # Browse available agents
@@ -53,10 +55,10 @@ conduct test --all
 
 ## Authentication
 
-Generate an API key from **Settings → API Keys** in the Conduct AI dashboard. Keys start with `cond_live_` and are stored as SHA-256 hashes — the plaintext is shown only once.
+Generate an agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard. Tokens start with `cond_agt_` and are stored as SHA-256 hashes — the plaintext is shown only once.
 
 ```bash
-conduct login --server https://api.conductai.ai --api-key cond_live_xxx --workspace <id>
+conduct login --server https://api.conductai.ai --token cond_agt_xxx --workspace <id>
 ```
 
 ## Install all agents
@@ -285,7 +287,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 }
 ```
 
-Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard.
 
 ---
 

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.8.3"
+version = "0.8.5"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }
@@ -44,4 +44,4 @@ where = ["src"]
 include = ["conduct_cli*"]
 
 [tool.setuptools.package-data]
-conduct_cli = ["paxel.py"]
+conduct_cli = ["paxel.py", "guard_policy.md"]

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli/guard.py

@@ -344,7 +344,8 @@ def _save_guard_config(data: dict, workspace_id: str | None = None):
             pass
     existing.update(data)
     CONFIG_PATH.write_text(json.dumps(existing, indent=2))
-    CONFIG_PATH.chmod(0o600)
+    from conduct_cli.hooks.base import restrict_to_owner
+    restrict_to_owner(CONFIG_PATH)
 
 
 def _require_guard_config() -> dict:
@@ -521,21 +522,7 @@ def _write_mcp_file(
         cfg_path.write_text(json.dumps(cfg, indent=2))
 
 
-_GUARD_RULES_TEXT = (
-    "## ConductGuard — AI Governance Policy\n\n"
-    "A ConductGuard MCP server is connected to this session (server name: `conduct-guard`).\n"
-    "All Guard policies are enforced through it. You MUST follow these rules:\n\n"
-    "Before executing any shell command, file write, network request, API call, or code change:\n"
-    "1. Call the `guard_check` tool from the `conduct-guard` MCP server with the action and parameters.\n"
-    "2. If the response is BLOCKED: stop immediately and explain the policy rule to the user. Do not proceed.\n"
-    "3. If the response is WARNING: proceed but surface the warning message to the user.\n"
-    "4. If the response is ALLOWED: proceed normally.\n\n"
-    "Always-on rules (no guard_check needed, enforce unconditionally):\n"
-    "- Never write credentials, API keys, tokens, or secrets to any file or output.\n"
-    "- Never send PII (emails, names, payment data) to external endpoints.\n\n"
-    "Use `guard_status` (conduct-guard MCP) to show the user their current policy and team info.\n"
-    "Use `guard_activity` at the start of every session with a one-line summary of what you are doing."
-)
+_GUARD_RULES_TEXT = (Path(__file__).parent / "guard_policy.md").read_text().rstrip()
 
 
 def _patch_cursor_global_rules() -> None:
@@ -608,14 +595,16 @@ def _patch_tool_instruction_files(agent_token: str, api_url: str, dry_run: bool
         (repo_root / ".cursorrules"                        if repo_root else None, Path.home() / ".cursor"  / "rules" / "conduct.md",   ".cursorrules"),
         (repo_root / ".windsurfrules"                      if repo_root else None, Path.home() / ".windsurf"/ "rules" / "conduct.md",   ".windsurfrules"),
     ]
-    pattern = _re.compile(_re.escape(MARKER_START) + r".*?" + _re.escape(MARKER_END), _re.DOTALL)
+    # Tolerate legacy marker variants (e.g. ", do not edit this block") so re-sync
+    # replaces old blocks in place instead of appending a second one.
+    pattern = _re.compile(r"<!-- ConductGuard[^\n]*-->.*?<!-- /ConductGuard -->", _re.DOTALL)
 
     for repo_path, global_path, label in targets:
         path = repo_path if (repo_path and repo_path.exists()) else global_path
         if not path.exists() and repo_path:
             path = repo_path
         existing = path.read_text() if path.exists() else ""
-        if MARKER_START in existing:
+        if pattern.search(existing):
             updated = pattern.sub(guard_block, existing)
             if dry_run:
                 if updated == existing:
@@ -1265,7 +1254,7 @@ def _report_tools_to_server() -> None:
 
         payload = json.dumps({"email": email, "tools": tools}).encode()
         headers = {"Content-Type": "application/json"}
-        if conduct_agent_token and conduct_agent_token.startswith("cond_live_"):
+        if conduct_agent_token:
             headers["Authorization"] = f"Bearer {conduct_agent_token}"
         elif token:
             headers["Authorization"] = f"Bearer {token}"
@@ -1450,7 +1439,7 @@ def cmd_guard_sync(args):
     _save_policy(policy)
     print(f"  {GREEN}Policy refreshed:{RESET} {rule_count} rule(s)")
 
-    # Refresh member token from server (workspace API key → fresh guard-mt- token).
+    # Refresh agent token from server via refresh_token grant.
     # Never rely on the locally-cached value — it may be stale or missing.
     try:
         installed = _req(
@@ -1490,9 +1479,11 @@ def cmd_guard_sync(args):
     agent_token = cfg.get("agent_token", "")
     rc_path, newly_sourced = _write_proxy_env(agent_token, proxy_url)
     if agent_token:
-        print(f"  {GREEN}Proxy env written:{RESET} ~/.conduct/env → {proxy_url}")
+        env_name = "env.ps1" if sys.platform == "win32" else "env"
+        activate_cmd = f". {rc_path}" if sys.platform == "win32" else f"source {rc_path}"
+        print(f"  {GREEN}Proxy env written:{RESET} ~/.conduct/{env_name} → {proxy_url}")
         if newly_sourced:
-            print(f"  {CYAN}Run `source {rc_path}` (or open a new shell) to activate.{RESET}")
+            print(f"  {CYAN}Run `{activate_cmd}` (or open a new shell) to activate.{RESET}")
 
     _tools = _detect_ai_tools()
     if _tools:
@@ -1668,6 +1659,62 @@ def _post_local_findings(cfg: dict, base_url: str, findings: list[dict]) -> None
         print(f"  {YELLOW}Audit upload skipped: {e}{RESET}")
 
 
+def _write_proxy_env_windows(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
+    """Windows equivalent of _write_proxy_env — PowerShell profile + env.ps1."""
+    CONDUCT_DIR.mkdir(parents=True, exist_ok=True)
+    token = agent_token
+    proxy = proxy_url.rstrip("/")
+
+    ps1_file = CONDUCT_DIR / "env.ps1"
+    ps1_file.write_text("\n".join([
+        SHELL_RC_MARKER,
+        "# Edit ~/.conduct/env-override.ps1 to add your own vars — sourced after this file.",
+        "",
+        f'$env:ANTHROPIC_BASE_URL = "{proxy}"',
+        f'$env:ANTHROPIC_API_KEY  = "{token}"',
+        "",
+        f'$env:OPENAI_BASE_URL = "{proxy}/openai"',
+        f'$env:OPENAI_API_KEY  = "{token}"',
+        "",
+        f'$env:PERPLEXITY_BASE_URL = "{proxy}/perplexity"',
+        f'$env:PERPLEXITY_API_KEY  = "{token}"',
+        "",
+        'if (Test-Path "$HOME/.conduct/env-override.ps1") { . "$HOME/.conduct/env-override.ps1" }',
+        "",
+    ]))
+
+    # ponytail: prefer PS7 profile; fall back to WPS5 only if its file already exists
+    ps7_profile = Path.home() / "Documents" / "PowerShell" / "Microsoft.PowerShell_profile.ps1"
+    wps5_profile = Path.home() / "Documents" / "WindowsPowerShell" / "Microsoft.PowerShell_profile.ps1"
+    if ps7_profile.parent.exists() or not wps5_profile.exists():
+        rc = ps7_profile
+    else:
+        rc = wps5_profile
+
+    existing = rc.read_text() if rc.exists() else ""
+    CLAUDE_ALIAS = (
+        "function claude { "
+        "$prev=$env:ANTHROPIC_BASE_URL; $env:ANTHROPIC_BASE_URL=$null; "
+        "try { & claude @args } finally { $env:ANTHROPIC_BASE_URL=$prev } }"
+    )
+    PS_SOURCE_LINE = 'if (Test-Path "$HOME/.conduct/env.ps1") { . "$HOME/.conduct/env.ps1" }'
+
+    if SHELL_RC_MARKER in existing:
+        if CLAUDE_ALIAS not in existing:
+            rc.write_text(existing.rstrip() + f"\n{CLAUDE_ALIAS}\n")
+            return rc, True
+        return rc, False
+
+    rc.parent.mkdir(parents=True, exist_ok=True)
+    addition = (
+        f"\n\n{SHELL_RC_MARKER}\n"
+        f"{PS_SOURCE_LINE}\n"
+        f"{CLAUDE_ALIAS}\n"
+    )
+    rc.write_text(existing.rstrip() + addition if existing else addition.lstrip())
+    return rc, True
+
+
 def _write_proxy_env(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
     """Write ~/.conduct/env with the 3 provider env-var pairs and ensure the
     user's shell rc sources it.
@@ -1681,8 +1728,11 @@ def _write_proxy_env(agent_token: str, proxy_url: str) -> tuple[Path, bool]:
         print(f"  {YELLOW}Proxy env skipped — no agent token in config{RESET}")
         return Path(), False
 
+    if sys.platform == "win32":
+        return _write_proxy_env_windows(agent_token, proxy_url)
+
     CONDUCT_DIR.mkdir(parents=True, exist_ok=True)
-    token = agent_token  # cond_agt_* used directly as the API key value
+    token = agent_token  # cond_agt_* used directly as the bearer value
     proxy = proxy_url.rstrip("/")
 
     PROXY_ENV_FILE.write_text("\n".join([

conduct_cli-0.8.5/src/conduct_cli/guard_policy.md

@@ -0,0 +1,16 @@
+At the start of every conversation:
+- Call `guard_activity` once with a one-line summary of the user's request.
+
+Before every shell command, file write, network request, API call, or code change:
+- Call `guard_check` with the proposed action and parameters.
+- If BLOCKED: stop and explain the policy rule.
+- If WARNING: proceed and surface the warning.
+- If ALLOWED: proceed normally.
+
+Example:
+1. User asks to fix a bug → call `guard_activity` once.
+2. Before reading files or running tests → call `guard_check`.
+3. Before editing code → call `guard_check` again.
+
+Never write secrets to files or output.
+Never send PII to external endpoints.

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli/hooks/base.py

@@ -1,7 +1,7 @@
 """Shared primitives for all ConductGuard hook modules.
 
-Everything here is stdlib-only so hooks work from a bare `pip install conduct-cli`
-with no shell rc sourced.
+Depends only on stdlib + psutil (a hard conduct-cli dep), so hooks work from a
+bare `pip install conduct-cli` with no shell rc sourced.
 """
 from __future__ import annotations
 
@@ -10,6 +10,8 @@ import subprocess
 import sys
 import time
 import urllib.request
+
+import psutil as _psutil
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Literal, Optional
@@ -57,6 +59,30 @@ def active_policy_path() -> Path:
     return POLICY_PATH
 
 
+def restrict_to_owner(path: Path) -> None:
+    """chmod 600 equivalent — POSIX uses chmod, Windows uses icacls to remove
+    inheritance and grant sole access to the current user."""
+    try:
+        if sys.platform == "win32":
+            # ponytail: icacls is built-in on windows; pywin32 would be a whole
+            # dep for one SetSecurityInfo call. Upgrade only if this breaks on
+            # non-English locales that rename builtin groups.
+            import os as _os
+            user = _os.environ.get("USERNAME") or _os.environ.get("USER") or ""
+            if not user:
+                return
+            subprocess.run(
+                ["icacls", str(path), "/inheritance:r", "/grant:r", f"{user}:F"],
+                check=False,
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+        else:
+            path.chmod(0o600)
+    except Exception:
+        pass
+
+
 # ── Repo / tool detection ─────────────────────────────────────────────────────
 
 def detect_repo() -> Optional[str]:
@@ -168,19 +194,18 @@ def _refresh_policy_from_api() -> None:
 
 def drain_daemon_status() -> tuple[str, int | None]:
     """Return (status, pid) where status is 'running'|'stale'|'dead'."""
-    import os as _os
     if not JOURNAL_PID_PATH.exists():
         return "dead", None
     try:
         pid = int(JOURNAL_PID_PATH.read_text().strip())
-        _os.kill(pid, 0)  # raises if process gone
+        # ponytail: psutil (already a dep) is portable — os.kill(pid, 0) hangs on Windows
+        if not _psutil.pid_exists(pid):
+            return "dead", None
         age = time.time() - JOURNAL_PID_PATH.stat().st_mtime
         if age > _DAEMON_STALE_SECS:
             return "stale", pid
         return "running", pid
-    except (ProcessLookupError, PermissionError, ValueError):
-        return "dead", None
-    except Exception:
+    except (ValueError, Exception):
         return "dead", None
 
 
@@ -197,18 +222,29 @@ def ensure_drain_daemon(hook_module_path: Optional[Path] = None) -> None:
             return
         # Kill stale process before spawning replacement — prevents double-drain race
         if status == "stale" and stale_pid is not None:
-            import os as _os
             try:
-                _os.kill(stale_pid, 15)  # SIGTERM
+                _psutil.Process(stale_pid).terminate()
             except Exception:
                 pass
         if hook_module_path is None:
             return
+        popen_kwargs: dict = {
+            "stdout": subprocess.DEVNULL,
+            "stderr": subprocess.DEVNULL,
+        }
+        if sys.platform == "win32":
+            # ponytail: DETACHED_PROCESS + CREATE_NEW_PROCESS_GROUP are the
+            # Windows equivalent of POSIX start_new_session — both constants
+            # only exist on Windows Python, so gate the reference behind the
+            # platform check.
+            popen_kwargs["creationflags"] = (
+                subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP
+            )
+        else:
+            popen_kwargs["start_new_session"] = True
         subprocess.Popen(
             [sys.executable, str(hook_module_path), "drain"],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            start_new_session=True,
+            **popen_kwargs,
         )
     except Exception:
         pass

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli/hooks/session_start.py

@@ -20,10 +20,12 @@ MAX_AGE_HOURS = 2
 
 
 def _check_proxy_token() -> None:
-    """Warn + alert server if the proxy token is missing or malformed.
+    """Warn + alert server if the proxy token is missing, malformed, or expired.
 
     Reads ~/.conduct/env directly (not shell env) so this works regardless
-    of whether the user sourced their rc file in this session.
+    of whether the user sourced their rc file in this session. Also cross-checks
+    token_expires_at from ~/.conduct/config.json so the hint says `conduct login`
+    (verb that actually refreshes) when the session token has aged out.
     """
     if not CONDUCT_ENV_PATH.exists():
         return
@@ -35,22 +37,42 @@ def _check_proxy_token() -> None:
     )
     if not has_base_url:
         return
-    if has_valid_token:
+
+    # Expired-session check: token present in env but config TTL already past.
+    expired = False
+    try:
+        cfg = load_config()
+        exp = cfg.get("token_expires_at", "")
+        if exp:
+            expired = datetime.fromisoformat(exp) < datetime.now(timezone.utc)
+    except Exception:
+        cfg = {}
+
+    if has_valid_token and not expired:
         return
 
-    print("## ConductGuard: proxy token missing or malformed")
-    print("Run `conduct guard sync` to refresh your token before making LLM calls.\n")
+    if expired:
+        print("## ConductGuard: session token expired")
+        print("Run `conduct login` to start a new session before making LLM calls.\n")
+        note = "token_expires_at in the past"
+        rule = "proxy_token_expired"
+        msg  = "Developer proxy session token expired — run conduct login"
+    else:
+        print("## ConductGuard: proxy token missing or malformed")
+        print("Run `conduct login` to refresh your token before making LLM calls.\n")
+        note = "proxy token not found in ~/.conduct/env"
+        rule = "proxy_token_missing"
+        msg  = "Developer proxy token missing or malformed — run conduct login"
 
     try:
-        cfg = load_config()
-        workspace_id  = cfg.get("workspace_id", "")
-        clerk_user_id = cfg.get("clerk_user_id", "") or cfg.get("user_email", "")
+        workspace_id  = (cfg or {}).get("workspace_id", "")
+        clerk_user_id = (cfg or {}).get("clerk_user_id", "") or (cfg or {}).get("user_email", "")
         post_event(
             "session_start",
-            {"note": "proxy token not found in ~/.conduct/env"},
+            {"note": note},
             "warned",
-            "proxy_token_missing",
-            "Developer proxy token missing or malformed — run conduct guard sync",
+            rule,
+            msg,
             session_id=None,
         )
     except Exception:

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli/main.py

@@ -358,7 +358,7 @@ def _report_tool_coverage() -> None:
 
         payload = json.dumps({"email": email, "tools": tools}).encode()
         headers = {"Content-Type": "application/json"}
-        if api_key and api_key.startswith("cond_live_"):
+        if api_key:
             headers["Authorization"] = f"Bearer {api_key}"
         elif token:
             headers["Authorization"] = f"Bearer {token}"
@@ -1348,10 +1348,8 @@ def _atomic_write(path: Path, data: dict) -> None:
     tmp = path.with_suffix(".tmp")
     tmp.write_text(json.dumps(existing, indent=2))
     os.replace(tmp, path)
-    try:
-        os.chmod(path, 0o600)
-    except Exception:
-        pass
+    from conduct_cli.hooks.base import restrict_to_owner
+    restrict_to_owner(path)
 
 
 def cmd_switch(args):
@@ -1445,8 +1443,9 @@ def cmd_switch(args):
 def cmd_whoami(args):
     cfg = _load_config()
 
-    workspace_id   = cfg.get("workspace", "")
-    server         = cfg.get("server", "—")
+    # cfg key drift: canonical keys are workspace_id / api_url, older configs used workspace / server
+    workspace_id   = cfg.get("workspace_id") or cfg.get("workspace") or ""
+    server         = cfg.get("api_url") or cfg.get("server") or "—"
     api_key        = cfg.get("agent_token", "")
 
     # Try to resolve workspace name from /projects
@@ -1458,8 +1457,8 @@ def cmd_whoami(args):
             match = next((p for p in projects if str(p.get("id", "")) == str(workspace_id)), None)
             if match:
                 workspace_name = match["name"]
-        except Exception:
-            pass
+        except (Exception, SystemExit):
+            pass  # server error on /projects (e.g. agent token → 500) is cosmetic
 
     ws_display = workspace_name if workspace_name else workspace_id
     ws_id_hint = f"  ({workspace_id[:8]})" if workspace_id else ""
@@ -1467,7 +1466,7 @@ def cmd_whoami(args):
 
     print(f"\n{BOLD}Workspace:{RESET}  {ws_display}{ws_id_hint}")
     print(f"{BOLD}Server:{RESET}     {server}")
-    print(f"{BOLD}API key:{RESET}    {api_key_display}")
+    print(f"{BOLD}Agent token:{RESET} {api_key_display}")
 
     # Guard section — all under ~/.conduct/
     policy_path = Path.home() / ".conduct" / "policy.json"
@@ -3197,7 +3196,7 @@ def main():
     sub.add_parser("token", help="Show your agent token (masked by default)")
 
     # conduct whoami
-    sub.add_parser("whoami", help="Show current workspace, server, API key, and Guard/Booster status")
+    sub.add_parser("whoami", help="Show current workspace, server, agent token, and Guard/Booster status")
 
     # conduct guard
     guard_p, _guard_sub = _guard.register_guard_parser(sub)

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.8.3
+Version: 0.8.5
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT
@@ -31,6 +31,8 @@ Requires-Dist: agent-booster[watch]>=0.6.6; extra == "booster"
 
 Official CLI for [Conduct AI](https://conductai.ai) — install AI agents, manage projects, run end-to-end tests, and enforce team AI policies with ConductGuard.
 
+Runs on Linux, macOS, and Windows. Python 3.9–3.12.
+
 ![Conduct CLI demo — whoami, switch workspaces with Guard policy sync, and run an agent](assets/conduct-cli-demo.gif)
 
 ## Install
@@ -45,7 +47,7 @@ pip install conduct-cli
 # Authenticate (one-time)
 conduct login \
   --server https://api.conductai.ai \
-  --api-key cond_live_xxx \
+  --token cond_agt_xxx \
   --workspace <workspace-id>
 
 # Browse available agents
@@ -81,10 +83,10 @@ conduct test --all
 
 ## Authentication
 
-Generate an API key from **Settings → API Keys** in the Conduct AI dashboard. Keys start with `cond_live_` and are stored as SHA-256 hashes — the plaintext is shown only once.
+Generate an agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard. Tokens start with `cond_agt_` and are stored as SHA-256 hashes — the plaintext is shown only once.
 
 ```bash
-conduct login --server https://api.conductai.ai --api-key cond_live_xxx --workspace <id>
+conduct login --server https://api.conductai.ai --token cond_agt_xxx --workspace <id>
 ```
 
 ## Install all agents
@@ -313,7 +315,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 }
 ```
 
-Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your member token from **Settings → API Keys** in the Conduct AI dashboard.
+Run `conduct login` first — `conduct-mcp` reads credentials from `~/.conduct/config.json`. Get your agent token from **Settings → Agents → Issue token** in the Conduct AI dashboard.
 
 ---
 

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/src/conduct_cli.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ setup.py
 src/conduct_cli/__init__.py
 src/conduct_cli/api.py
 src/conduct_cli/guard.py
+src/conduct_cli/guard_policy.md
 src/conduct_cli/guardmcp.py
 src/conduct_cli/log_util.py
 src/conduct_cli/main.py
@@ -41,6 +42,7 @@ tests/test_journal_drain.py
 tests/test_log_util.py
 tests/test_proxy_coverage.py
 tests/test_proxy_env.py
+tests/test_report_tool_coverage.py
 tests/test_signed_policy.py
 tests/test_switch.py
 tests/test_token_lifecycle.py

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/tests/test_advisory_and_hook.py

@@ -549,38 +549,6 @@ class TestInvalidStdin:
 class TestFailClosedApiUnreachable:
     """fail_closed + policy exists + budget API unreachable → blocks with clear message."""
 
-    def test_api_unreachable_blocks_with_clear_message(self, monkeypatch, tmp_path, capsys):
-        import conduct_cli.hooks.pretooluse as pt
-        from io import StringIO
-
-        policy_file = tmp_path / "policy.json"
-        policy_file.write_text('{"rules": [], "fail_mode": "fail_closed"}')
-
-        monkeypatch.setattr(pt, "active_policy_path", lambda: policy_file)
-        monkeypatch.setattr(pt, "_get_fail_mode", lambda: "fail_closed")
-        monkeypatch.setattr(pt, "_get_advisory_mode", lambda: False)
-        monkeypatch.setattr(pt, "_maybe_sync_policy", lambda: None)
-        monkeypatch.setattr(pt, "_should_periodic_flush", lambda: False)
-        # Budget cache miss, then API unreachable → returns (False, None)
-        monkeypatch.setattr(pt, "_load_budget_cache", lambda: (None, None))
-        monkeypatch.setattr(pt, "_fetch_budget_status", lambda: (False, None))
-
-        posted: list[dict] = []
-        def _fake_post(tn, ti, decision, rule_id, msg, sid, **kw):
-            posted.append({"decision": decision, "rule_id": rule_id, "msg": msg})
-        monkeypatch.setattr(pt, "post_event", _fake_post)
-        monkeypatch.setattr(sys, "stdin", StringIO(_hook_input()))
-
-        with pytest.raises(SystemExit) as exc:
-            pt.main()
-
-        assert exc.value.code == 2
-        assert posted[0]["decision"] == "blocked"
-        assert posted[0]["rule_id"] == "guard-unavailable"
-        # Message must say "unreachable", not "budget"
-        assert "unreachable" in posted[0]["msg"].lower()
-        assert "budget" not in posted[0]["msg"].lower()
-
     def test_api_unreachable_fail_open_passes(self, monkeypatch, tmp_path):
         """Same scenario but fail_open → should NOT block."""
         import conduct_cli.hooks.pretooluse as pt

{conduct_cli-0.8.3 → conduct_cli-0.8.5}/tests/test_api_client.py

@@ -63,18 +63,6 @@ def test_headers_sets_bearer_when_token_given():
     assert "X-Api-Key" not in h
 
 
-def test_headers_sets_api_key_and_no_authorization():
-    h = headers("ws-1", api_key="key-abc")
-    assert h["X-Api-Key"] == "key-abc"
-    assert "Authorization" not in h
-
-
-def test_headers_api_key_takes_precedence_over_token():
-    h = headers("ws-1", token="tok", api_key="key")
-    assert h["X-Api-Key"] == "key"
-    assert "Authorization" not in h
-
-
 def test_headers_custom_content_type():
     h = headers("ws-1", content_type="text/plain")
     assert h["Content-Type"] == "text/plain"