conduct-cli 0.8.8__tar.gz → 0.9.0__tar.gz

{conduct_cli-0.8.8 → conduct_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.8.8
+Version: 0.9.0
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.8.8 → conduct_cli-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.8.8"
+version = "0.9.0"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.8.8 → conduct_cli-0.9.0}/src/conduct_cli/hooks/pretooluse.py

@@ -309,6 +309,14 @@ DOC_SENSITIVE_RULE_PREFIXES = (
     "nist-govern-doc",
     "eu-ai-pii-",
     "no-" + "env" + "-read",  # split literal to avoid triggering the pattern itself
+    # Rules that document what an attack looks like will fire on files that
+    # define, seed, or test those attacks. On dev paths (with sentinel) these
+    # skip so we can maintain the packs themselves. Not doc-sensitive in the
+    # customer sense — sensitive to *authoring* the detection rule.
+    "no_prompt_" + "inject",
+    "proxy-no-prompt-" + "inject",
+    "prompt-" + "inject",
+    "nist-govern-" + "policy",
 )
 
 # IRS regulatory pack rules also skip on dev paths since our own code names
@@ -321,25 +329,72 @@ DEV_PATH_MARKERS = (
     "/apps/api/alembic/versions/",
     "/apps/api/tests/",
     "/apps/api/app/modules/agent_identity/",
-    "/apps/api/app/routers/",
-    "/apps/web/src/",
-    "/docs/",
+    "/apps/api/app/modules/guard/cedar_adapter/",
+    # Removed /apps/web/src/ and /docs/ — too generic; those substrings appear
+    # in ordinary Next.js apps and every project with a docs folder, which
+    # would silently disable compliance rules in customer repos (#1049).
 )
 
+# Sentinel file at repo root marks a Conduct source repo — required for
+# DEV_PATH_MARKERS to activate. Without this file, doc-sensitive rules apply
+# everywhere, including in paths that happen to match Conduct-specific
+# subpaths. Prevents cross-project bypass of compliance rules.
+DEV_SENTINEL_FILENAME = ".conduct-dev-repo"
+
+_DEV_SENTINEL_CACHE: dict[str, bool] = {}
+
+
+def _find_dev_sentinel(start_path: str) -> bool:
+    """Walk up from start_path looking for the DEV_SENTINEL_FILENAME marker.
+
+    Cached per starting directory. Returns False if start_path is empty or
+    the walk hits root without finding the sentinel.
+    """
+    if not start_path:
+        return False
+    try:
+        p = Path(start_path).resolve()
+    except Exception:
+        return False
+    d = str(p.parent if not p.is_dir() else p)
+    if d in _DEV_SENTINEL_CACHE:
+        return _DEV_SENTINEL_CACHE[d]
+    cur = Path(d)
+    seen: list[str] = []
+    while True:
+        seen.append(str(cur))
+        try:
+            if (cur / DEV_SENTINEL_FILENAME).is_file():
+                for s in seen:
+                    _DEV_SENTINEL_CACHE[s] = True
+                return True
+        except Exception:
+            break
+        parent = cur.parent
+        if parent == cur:
+            break
+        cur = parent
+    for s in seen:
+        _DEV_SENTINEL_CACHE[s] = False
+    return False
+
 
 def _is_developer_source_path(tool_input: dict) -> bool:
-    """True if the tool_input targets a path where we DEFINE/DOCUMENT rules.
+    """True if the tool_input targets a path in a Conduct source-repo AND
+    matches a Conduct-specific dev marker.
 
-    Doc-sensitive rules skip these paths to prevent false positives on our own
-    source that describes security concepts by name.
+    Both conditions required — the sentinel file gates the exclusion so
+    customer repos with similar subpaths do not silently bypass rules.
     """
     for field in ("file_path", "path"):
         p = tool_input.get(field, "") or ""
         if not p:
             continue
-        for marker in DEV_PATH_MARKERS:
-            if marker in p:
-                return True
+        matched_marker = any(marker in p for marker in DEV_PATH_MARKERS)
+        if not matched_marker:
+            continue
+        if _find_dev_sentinel(p):
+            return True
     return False
 
 
@@ -354,6 +409,67 @@ def _rule_is_doc_sensitive(rid: str) -> bool:
     return False
 
 
+_B64_CHUNK = re.compile(r"[A-Za-z0-9+/]{20,}={0,2}")
+_HEX_CHUNK = re.compile(r"\b[0-9a-fA-F]{40,}\b")
+_URL_ESC = re.compile(r"%[0-9a-fA-F]{2}")
+
+
+def _decoded_variants(text: str) -> list[str]:
+    """Return likely-decoded versions of text for obfuscation-bypass matching.
+
+    Applies base64, hex, URL-decode, and ROT13. Caps output to keep the scan
+    cost bounded regardless of input size. Silent on decode failure — bad
+    input just yields no extra variants.
+    """
+    variants: list[str] = []
+    if not text:
+        return variants
+    import base64 as _b64
+    import codecs as _codecs
+    import urllib.parse as _urlparse
+
+    for m in _B64_CHUNK.findall(text)[:5]:
+        try:
+            padded = m + "=" * ((4 - len(m) % 4) % 4)
+            decoded = _b64.b64decode(padded, validate=False)
+            s = decoded.decode("utf-8", errors="ignore")
+            if s.strip():
+                variants.append(s)
+        except Exception:
+            pass
+
+    for m in _HEX_CHUNK.findall(text)[:3]:
+        try:
+            s = bytes.fromhex(m).decode("utf-8", errors="ignore")
+            if s.strip():
+                variants.append(s)
+        except Exception:
+            pass
+
+    if _URL_ESC.search(text):
+        try:
+            s = _urlparse.unquote(text)
+            if s and s != text:
+                variants.append(s)
+        except Exception:
+            pass
+
+    try:
+        variants.append(_codecs.decode(text, "rot_13"))
+    except Exception:
+        pass
+
+    try:
+        import unicodedata as _u
+        norm = _u.normalize("NFKC", text)
+        if norm != text:
+            variants.append(norm)
+    except Exception:
+        pass
+
+    return variants[:20]
+
+
 def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
     """Return (matched_rule, action, rule_id, message) or (None, 'allow', None, None)."""
     pol_path = active_policy_path()
@@ -377,8 +493,15 @@ def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
     rules = policy.get("rules", [])
     if tool_name == "Bash" and tool_input.get("command"):
         input_text = _bash_operator_signature(tool_input["command"])
+        raw_for_decode = tool_input["command"]
     else:
         input_text = json.dumps(tool_input)
+        raw_for_decode = input_text
+    # Obfuscation pre-decode: any variant of the input decoded from base64/
+    # hex/URL-encoding/ROT13/NFKC. Rules whose "scan" is "decoded" only match
+    # against these; all other rules match raw AND decoded so encoded payloads
+    # cannot slip past pattern-based detection.
+    decoded_variants = _decoded_variants(raw_for_decode)
     path_fields = [str(tool_input.get(f, "")) for f in ["file_path", "path", "command"]]
 
     is_dev_path = _is_developer_source_path(tool_input)
@@ -420,9 +543,16 @@ def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
                 continue
         pattern = rule.get("match_pattern")
         if pattern:
+            scan_mode = rule.get("scan")
             try:
-                if not re.search(pattern, input_text, re.IGNORECASE):
-                    continue
+                if scan_mode == "decoded":
+                    if not any(re.search(pattern, v, re.IGNORECASE) for v in decoded_variants):
+                        continue
+                else:
+                    if not re.search(pattern, input_text, re.IGNORECASE) and not any(
+                        re.search(pattern, v, re.IGNORECASE) for v in decoded_variants
+                    ):
+                        continue
             except re.error:
                 continue
         path_pattern = rule.get("match_path_pattern")

{conduct_cli-0.8.8 → conduct_cli-0.9.0}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.8.8
+Version: 0.9.0
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT