conduct-cli 0.9.0__tar.gz → 0.9.2__tar.gz

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.9.0"
+version = "0.9.2"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/src/conduct_cli/guard.py

@@ -2310,6 +2310,11 @@ def register_guard_parser(sub):
     # conduct guard savings --team
     guard_sub.add_parser("savings", help="Show org-level token savings across all developers")
 
+    # conduct guard simulate --as-okta-agent <jwt-or-file>  (#1057)
+    sim_p = guard_sub.add_parser("simulate", help="Simulate a Guard-authenticated request without executing anything")
+    sim_p.add_argument("--as-okta-agent", dest="as_okta_agent", metavar="JWT-OR-FILE",
+                       help="Okta-issued JWT string, or a path to a file containing one")
+
     # conduct guard audit [--since 7d]
     audit_p = guard_sub.add_parser("audit", help="Show recent guard events")
     audit_p.add_argument(
@@ -3102,6 +3107,77 @@ def cmd_verify(args) -> None:
         sys.exit(1)
 
 
+
+def cmd_guard_simulate(args):
+    """conduct guard simulate --as-okta-agent <jwt-or-file>
+
+    Runs an *authenticated* GET /auth/whoami against the configured API,
+    using the supplied JWT as the Bearer token. Prints what auth resolved
+    to — identity name, source, source_id, lifecycle_state — so an
+    operator can verify their Okta setup end-to-end before wiring a real
+    agent. Purely a read-only probe; nothing is executed on the server.
+
+    Explicitly labelled a *simulation* — do not use this as a production
+    auth path.
+    """
+    import json as _json
+    import urllib.error as _uerr
+    import urllib.request as _ureq
+    from pathlib import Path as _Path
+
+    raw = getattr(args, "as_okta_agent", None)
+    if not raw:
+        print("Missing --as-okta-agent <jwt-or-file>", file=sys.stderr)
+        sys.exit(2)
+
+    _p = _Path(raw)
+    if _p.exists() and _p.is_file():
+        jwt = _p.read_text().strip()
+    else:
+        jwt = raw.strip()
+
+    if jwt.count(".") != 2:
+        print("Value does not look like a JWT (expected three dot-separated segments).", file=sys.stderr)
+        sys.exit(2)
+
+    cfg = _require_guard_config()
+    api = _api_url(cfg)
+    ws = cfg.get("workspace_id") or cfg.get("workspace")
+    if not ws:
+        print("No workspace configured — run `conduct login` first.", file=sys.stderr)
+        sys.exit(2)
+
+    url = f"{api.rstrip('/')}/auth/whoami?workspace_id={ws}"
+    req = _ureq.Request(url, headers={
+        "Authorization": f"Bearer {jwt}",
+        "Accept": "application/json",
+        "User-Agent": "Conduct-Guard-Simulate/1.0",
+    })
+    print(f"[simulation] GET {url}")
+    try:
+        with _ureq.urlopen(req, timeout=15) as resp:
+            body = _json.loads(resp.read().decode("utf-8"))
+    except _uerr.HTTPError as e:
+        try:
+            detail = _json.loads(e.read().decode("utf-8"))
+        except Exception:
+            detail = {"detail": e.reason}
+        print(f"[simulation] HTTP {e.code}: {detail.get('detail', detail)}")
+        sys.exit(1)
+    except _uerr.URLError as e:
+        print(f"[simulation] connection failed: {e.reason}", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"[simulation] workspace: {body.get('workspace_id')}")
+    print(f"[simulation] token kind: {body.get('token_kind')}")
+    ident = body.get("identity")
+    if ident:
+        print(f"[simulation] identity   : {ident.get('name')} ({ident.get('source')}:{ident.get('source_id')})")
+        print(f"[simulation] lifecycle  : {ident.get('lifecycle_state')}")
+    else:
+        print("[simulation] identity   : (none — token did not resolve to an AgentIdentity)")
+
+
 def dispatch_guard(args, guard_p):
     """Dispatch to the correct guard handler. Called from main()."""
     guard_command = getattr(args, "guard_command", None)
@@ -3127,6 +3203,8 @@ def dispatch_guard(args, guard_p):
         cmd_guard_debug_hook(args)
     elif guard_command == "session":
         cmd_guard_session(args)
+    elif guard_command == "simulate":
+        cmd_guard_simulate(args)
     else:
         guard_p.print_help()
         sys.exit(1)

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/src/conduct_cli/hooks/pretooluse.py

@@ -299,6 +299,57 @@ def _bash_operator_signature(command: str) -> str:
     return " ; ".join(parts)
 
 
+# Flags whose value is prose meant for humans (issue bodies, commit messages,
+# PR descriptions, titles). Values here are excluded from pattern + decode
+# scanning so natural-language content does not trip pack regexes that were
+# only meant to catch CLI/env forms.
+_CONTENT_FLAGS = {
+    "--body", "--body-file", "-b",
+    "--message", "-m",
+    "--description", "-d",
+    "--title", "-t",
+    "--comment", "-c",
+    "--note",
+}
+
+
+def _bash_scan_target(command: str) -> str:
+    """Return command with content-flag values stripped, for pattern + decode scanning.
+
+    Preserves operator signature (argv, subcommands, flag names, paths, env
+    vars) so obfuscation-detection still works on the shell parts. Strips
+    only the prose-holding argument values that follow content flags.
+    """
+    if not command:
+        return ""
+    segments = re.split(r"&&|\|\||\|(?!\|)|;", command)
+    parts = []
+    for seg in segments:
+        try:
+            tokens = shlex.split(seg.strip())
+        except ValueError:
+            parts.append(seg.strip())
+            continue
+        keep = []
+        skip_next = False
+        for t in tokens:
+            if skip_next:
+                skip_next = False
+                continue
+            if t in _CONTENT_FLAGS:
+                keep.append(t)
+                skip_next = True
+                continue
+            if t.startswith("--") and "=" in t:
+                flag_name = t.split("=", 1)[0]
+                if flag_name in _CONTENT_FLAGS:
+                    keep.append(flag_name)
+                    continue
+            keep.append(t)
+        parts.append(" ".join(keep))
+    return " ; ".join(parts)
+
+
 # Framework rule prefixes known to false-positive on files that DEFINE, DOCUMENT,
 # or TEST security concepts. On paths under DEV_PATH_MARKERS these skip.
 # Fix for #1048. Prefix match rather than literal to avoid our own scanner triggers.
@@ -317,6 +368,14 @@ DOC_SENSITIVE_RULE_PREFIXES = (
     "proxy-no-prompt-" + "inject",
     "prompt-" + "inject",
     "nist-govern-" + "policy",
+    # Endpoint-attack pack (mirrors Numbat coverage). Rules match reverse
+    # shells, private-key reads, cloud metadata recon, persistence, etc. —
+    # patterns that would fire on the pack file itself when authoring it.
+    "endpoint-" + "attack",
+    # Filesystem-recon and network-egress rules fire on files that name
+    # credential paths, which is what the endpoint-attack pack does.
+    "no_" + "recon_fs",
+    "no_" + "network_egress",
 )
 
 # IRS regulatory pack rules also skip on dev paths since our own code names
@@ -330,9 +389,12 @@ DEV_PATH_MARKERS = (
     "/apps/api/tests/",
     "/apps/api/app/modules/agent_identity/",
     "/apps/api/app/modules/guard/cedar_adapter/",
+    "/apps/api/app/routers/",  # Conduct's own integration routers; still gated by sentinel
     # Removed /apps/web/src/ and /docs/ — too generic; those substrings appear
     # in ordinary Next.js apps and every project with a docs folder, which
     # would silently disable compliance rules in customer repos (#1049).
+    # /apps/api/app/routers/ kept because the sentinel gate prevents it
+    # from firing in customer repos that happen to share the subpath.
 )
 
 # Sentinel file at repo root marks a Conduct source repo — required for
@@ -493,7 +555,7 @@ def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
     rules = policy.get("rules", [])
     if tool_name == "Bash" and tool_input.get("command"):
         input_text = _bash_operator_signature(tool_input["command"])
-        raw_for_decode = tool_input["command"]
+        raw_for_decode = _bash_scan_target(tool_input["command"])
     else:
         input_text = json.dumps(tool_input)
         raw_for_decode = input_text

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.0 → conduct_cli-0.9.2}/src/conduct_cli.egg-info/SOURCES.txt

@@ -30,7 +30,9 @@ src/conduct_cli/hooks/stop.py
 tests/test_advisory_and_hook.py
 tests/test_api_client.py
 tests/test_bash_operator_signature.py
+tests/test_bash_scan_target.py
 tests/test_blast_radius.py
+tests/test_cli_matrix.py
 tests/test_cmd_run.py
 tests/test_command_word_matcher.py
 tests/test_drain_daemon_health.py

conduct_cli-0.9.2/tests/test_bash_scan_target.py

@@ -0,0 +1,141 @@
+"""Tests for _bash_scan_target — content-flag stripping for pattern scanning.
+
+Regression tests for the nist-govern-policy-bypass false-positive fix:
+prose inside --body / -m / --description / --title should NOT be scanned
+against pack regexes, but shell operators, subcommands, and non-content
+flag values must still be scanned so obfuscation-detection works.
+"""
+import re
+
+import pytest
+
+from conduct_cli.hooks.pretooluse import (
+    _bash_operator_signature,
+    _bash_scan_target,
+)
+
+
+class TestBashScanTargetContentStripping:
+    """Content-flag values must not appear in the scan target."""
+
+    def test_strips_gh_issue_body_prose(self):
+        cmd = 'gh issue create --title "T" --body "words that pack regex should NOT see"'
+        out = _bash_scan_target(cmd)
+        assert "words that pack regex" not in out
+        assert "--body" in out
+        assert "--title" in out
+        assert "gh issue create" in out
+
+    def test_strips_git_commit_message(self):
+        cmd = 'git commit -m "some prose that a pack regex should not match against"'
+        out = _bash_scan_target(cmd)
+        assert "some prose" not in out
+        assert "-m" in out
+        assert "git commit" in out
+
+    def test_strips_body_equals_form(self):
+        cmd = 'gh pr create --body="inline prose value"'
+        out = _bash_scan_target(cmd)
+        assert "inline prose value" not in out
+        assert "--body" in out
+
+    def test_strips_description_flag(self):
+        cmd = 'gh pr edit 42 --description "long description text"'
+        out = _bash_scan_target(cmd)
+        assert "long description" not in out
+        assert "--description" in out
+
+
+class TestBashScanTargetPreservesOperators:
+    """Shell operators and non-content flags must still be scannable."""
+
+    def test_preserves_argv_and_subcommand(self):
+        cmd = 'gh issue create --title "T" --body "prose"'
+        out = _bash_scan_target(cmd)
+        assert "gh" in out
+        assert "issue" in out
+        assert "create" in out
+
+    def test_preserves_pipe_chain_segments(self):
+        cmd = 'cat file.txt | grep foo && echo done'
+        out = _bash_scan_target(cmd)
+        assert "cat" in out
+        assert "file.txt" in out
+        assert "grep" in out
+        assert "echo" in out
+        assert "done" in out
+
+    def test_preserves_non_content_flag_values(self):
+        cmd = 'curl -H "X-Custom: value" https://example.com/api'
+        out = _bash_scan_target(cmd)
+        # -H is NOT a content flag, so its value stays
+        assert "X-Custom" in out or "value" in out
+        assert "https://example.com/api" in out
+
+
+class TestBashScanTargetEdgeCases:
+    def test_empty_command_returns_empty(self):
+        assert _bash_scan_target("") == ""
+        assert _bash_scan_target(None) == ""
+
+    def test_unparseable_segment_falls_back_to_raw(self):
+        # shlex can fail on unclosed quotes or heredocs; fallback must preserve
+        # the segment so obfuscation-detection still has something to scan.
+        cmd = 'echo "unclosed'
+        out = _bash_scan_target(cmd)
+        assert "echo" in out
+
+
+class TestNistGovernPolicyBypassRegression:
+    """The specific false-positive that motivated the fix.
+
+    Pack rule nist-govern-policy-bypass (conduct-nist-ai-rmf 1.0.1) should
+    NOT fire on prose bodies. Uses the NARROWED pattern from 1.0.1.
+    """
+
+    NARROWED_PATTERN = (
+        r"(--"
+        + "dis" + "able" + r"[- _]?"
+        + "pol" + "icy" + r"\b"
+        + r"|--no[- _]?"
+        + "pol" + "icy" + r"\b"
+        + r"|"
+        + "pol" + "icy_enabled" + r"\s*[:=]\s*(false|0|null|off)"
+        + r"|"
+        + "gov" + "ernance" + r"\s*[:=]\s*(false|0|null|off)"
+        + r"|GUARD_DISABLED\s*[:=]\s*(1|true)"
+        + r"|export\s+GUARD_DISABLED)"
+    )
+
+    def test_prose_bodies_do_not_match(self):
+        """The whole reason this fix exists."""
+        prose_commands = [
+            'gh issue create --body "deactivating a workflow should still enforce the workspace policy"',
+            'git commit -m "fix: stop expired tokens from bypassing the guard"',
+            'gh pr create --body "This PR narrows the pattern so it does not disable the policy scanner"',
+        ]
+        for cmd in prose_commands:
+            target = _bash_scan_target(cmd)
+            assert not re.search(self.NARROWED_PATTERN, target, re.IGNORECASE), (
+                f"False positive on prose: {cmd!r} produced scan target {target!r}"
+            )
+
+    def test_real_bypass_forms_still_match(self):
+        """Narrowing must not lose the security intent."""
+        bypass_commands = [
+            "conductguard --disable-policy",
+            "conductguard --no-policy",
+            "export GUARD_DISABLED=1",
+            "GUARD_DISABLED=true conductguard run",
+        ]
+        for cmd in bypass_commands:
+            target = _bash_scan_target(cmd)
+            assert re.search(self.NARROWED_PATTERN, target, re.IGNORECASE), (
+                f"Real bypass missed: {cmd!r} produced scan target {target!r}"
+            )
+
+
+if __name__ == "__main__":
+    # Runnable self-check per repo convention (ponytail: one runnable check)
+    import sys
+    sys.exit(pytest.main([__file__, "-v"]))

conduct_cli-0.9.2/tests/test_cli_matrix.py

@@ -0,0 +1,180 @@
+"""CLI command matrix — Phase 2 of the test-harness plan.
+
+Recursively discovers every `conduct` subcommand from `--help` output and
+parametrises three checks per command:
+
+  A. `--help` exits 0                       (import/parser wiring intact)
+  B. No arguments exits non-zero            (no command silently does nothing)
+  C. When it hits the API, it hits the URL  (auth boundary — CONDUCT_SERVER
+     override reaches a local 401 mock; assert we saw traffic OR the command
+     is on the OFFLINE_ONLY list)
+
+Every rung is auto-generated from the CLI itself — new subcommand added?
+Test picks it up. No hardcoded command list to drift.
+"""
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import socket
+import subprocess
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+
+CONDUCT = shutil.which("conduct") or "conduct"
+
+# Commands that intentionally do NOT touch the API (local ops only).
+# Kept small on purpose — add sparingly, with a comment.
+OFFLINE_ONLY: set[tuple[str, ...]] = {
+    ("login",),               # opens browser, no direct API from CLI process
+    ("mcp", "install"),       # writes local Claude/Codex config
+    ("session-report",),      # scans local files
+    ("test-guard",),          # local synthetic events
+    ("test-security",),       # local synthetic findings
+}
+
+# Match `{a,b,c}` in the argparse "positional arguments:" section only.
+# Option choices like `--flag {yes,no}` and unrelated braces in help text
+# are ignored — that block is where argparse renders subparser groups.
+POSITIONAL_BLOCK_RE = re.compile(
+    r"positional arguments:\s*\n\s*\{([^\{\}]+)\}",
+    re.MULTILINE,
+)
+
+
+# ── Discovery ────────────────────────────────────────────────────────────────
+def _help(path: tuple[str, ...]) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [CONDUCT, *path, "--help"],
+        capture_output=True, text=True, timeout=15,
+    )
+
+
+def _subcommands_of(path: tuple[str, ...]) -> list[str]:
+    r = _help(path)
+    if r.returncode != 0:
+        return []
+    m = POSITIONAL_BLOCK_RE.search(r.stdout)
+    if not m:
+        return []
+    return [s.strip() for s in m.group(1).split(",") if s.strip()]
+
+
+def _walk(path: tuple[str, ...] = (), depth: int = 0, parent_children=()) -> list[tuple[str, ...]]:
+    # Depth cap: real tree is at most 3 deep (e.g. `guard session start`).
+    if depth > 3:
+        return []
+    out = [path] if path else []
+    children = _subcommands_of(path)
+    # `debug-hook <hook>` shows the same choice-list as `debug-hook` — argparse
+    # renders positional choices identically to subparser groups. Detect and stop.
+    if tuple(children) == parent_children:
+        return out
+    for child in children:
+        out.extend(_walk(path + (child,), depth + 1, tuple(children)))
+    return out
+
+
+try:
+    ALL_COMMANDS: list[tuple[str, ...]] = [p for p in _walk() if p]
+except (FileNotFoundError, subprocess.SubprocessError):
+    ALL_COMMANDS = []
+
+
+# ── Mock server ──────────────────────────────────────────────────────────────
+class _Recorder(BaseHTTPRequestHandler):
+    hits: list[str] = []
+
+    def do_GET(self): self._respond()
+    def do_POST(self): self._respond()
+    def do_PUT(self): self._respond()
+    def do_DELETE(self): self._respond()
+    def do_PATCH(self): self._respond()
+
+    def _respond(self):
+        _Recorder.hits.append(f"{self.command} {self.path}")
+        self.send_response(401)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(b'{"detail": "mock 401"}')
+
+    def log_message(self, *_):  # keep test output clean
+        pass
+
+
+@pytest.fixture(scope="module")
+def mock_server():
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    server = ThreadingHTTPServer(("127.0.0.1", port), _Recorder)
+    t = threading.Thread(target=server.serve_forever, daemon=True)
+    t.start()
+    yield f"http://127.0.0.1:{port}"
+    server.shutdown()
+
+
+# ── Tests ────────────────────────────────────────────────────────────────────
+def test_cli_installed():
+    assert CONDUCT and Path(CONDUCT).exists(), (
+        "`conduct` binary not on PATH — install with `pip install -e packages/conduct-cli`"
+    )
+
+
+def test_commands_discovered():
+    assert ALL_COMMANDS, "No subcommands discovered — CLI parser or --help broken"
+
+
+@pytest.mark.parametrize("cmd", ALL_COMMANDS, ids=[" ".join(c) for c in ALL_COMMANDS])
+def test_help_succeeds(cmd):
+    """Every command / subcommand must respond to --help with exit 0."""
+    r = _help(cmd)
+    assert r.returncode == 0, (
+        f'conduct {" ".join(cmd)} --help exited {r.returncode}\n'
+        f'stdout: {r.stdout[-400:]}\nstderr: {r.stderr[-400:]}'
+    )
+
+
+def _leaf_commands() -> list[tuple[str, ...]]:
+    """Only commands with NO sub-subcommands (actual invokable actions)."""
+    return [c for c in ALL_COMMANDS if not _subcommands_of(c)]
+
+
+LEAVES = _leaf_commands()
+
+
+@pytest.mark.matrix
+@pytest.mark.parametrize("cmd", LEAVES, ids=[" ".join(c) for c in LEAVES])
+def test_auth_boundary(cmd, mock_server, tmp_path, monkeypatch):
+    """No leaf command should complete cleanly against an unauthenticated
+    server. Either it hits the mock (proves it tried to auth) or it's on
+    OFFLINE_ONLY (proves we know it's local-only)."""
+    if cmd in OFFLINE_ONLY:
+        pytest.skip(f"{' '.join(cmd)} is documented as offline-only")
+
+    _Recorder.hits.clear()
+    env = os.environ.copy()
+    env.update({
+        "CONDUCT_SERVER": mock_server,
+        "HOME": str(tmp_path),                  # isolate ~/.conduct/config.json
+        "USERPROFILE": str(tmp_path),           # Windows equivalent
+        "CONDUCT_NON_INTERACTIVE": "1",
+        "NO_COLOR": "1",
+    })
+    r = subprocess.run(
+        [CONDUCT, *cmd],
+        capture_output=True, text=True, timeout=20, env=env,
+    )
+    hit_server = bool(_Recorder.hits)
+    exited_nonzero = r.returncode != 0
+
+    assert hit_server or exited_nonzero, (
+        f'conduct {" ".join(cmd)} exited 0 without touching the API — '
+        f'either it needs auth (bug) or add it to OFFLINE_ONLY.\n'
+        f'stdout: {r.stdout[-400:]}\nstderr: {r.stderr[-400:]}'
+    )