conduct-cli 0.9.0__tar.gz → 0.9.3__tar.gz

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.0
+Version: 0.9.3
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.9.0"
+version = "0.9.3"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/src/conduct_cli/guard.py

@@ -353,10 +353,10 @@ def _require_guard_config() -> dict:
     ws = cfg.get("workspace_id") or cfg.get("workspace")
     if not cfg or not ws:
         print(f"{RED}Guard not connected. Run: conduct login{RESET}", file=sys.stderr)
-        sys.exit(0)
+        sys.exit(1)
     if not cfg.get("agent_token"):
         print(f"{RED}Guard config is missing credentials. Run: conduct login{RESET}", file=sys.stderr)
-        sys.exit(0)
+        sys.exit(1)
     return cfg
 
 
@@ -2310,6 +2310,11 @@ def register_guard_parser(sub):
     # conduct guard savings --team
     guard_sub.add_parser("savings", help="Show org-level token savings across all developers")
 
+    # conduct guard simulate --as-okta-agent <jwt-or-file>  (#1057)
+    sim_p = guard_sub.add_parser("simulate", help="Simulate a Guard-authenticated request without executing anything")
+    sim_p.add_argument("--as-okta-agent", dest="as_okta_agent", metavar="JWT-OR-FILE",
+                       help="Okta-issued JWT string, or a path to a file containing one")
+
     # conduct guard audit [--since 7d]
     audit_p = guard_sub.add_parser("audit", help="Show recent guard events")
     audit_p.add_argument(
@@ -3102,6 +3107,77 @@ def cmd_verify(args) -> None:
         sys.exit(1)
 
 
+
+def cmd_guard_simulate(args):
+    """conduct guard simulate --as-okta-agent <jwt-or-file>
+
+    Runs an *authenticated* GET /auth/whoami against the configured API,
+    using the supplied JWT as the Bearer token. Prints what auth resolved
+    to — identity name, source, source_id, lifecycle_state — so an
+    operator can verify their Okta setup end-to-end before wiring a real
+    agent. Purely a read-only probe; nothing is executed on the server.
+
+    Explicitly labelled a *simulation* — do not use this as a production
+    auth path.
+    """
+    import json as _json
+    import urllib.error as _uerr
+    import urllib.request as _ureq
+    from pathlib import Path as _Path
+
+    raw = getattr(args, "as_okta_agent", None)
+    if not raw:
+        print("Missing --as-okta-agent <jwt-or-file>", file=sys.stderr)
+        sys.exit(2)
+
+    _p = _Path(raw)
+    if _p.exists() and _p.is_file():
+        jwt = _p.read_text().strip()
+    else:
+        jwt = raw.strip()
+
+    if jwt.count(".") != 2:
+        print("Value does not look like a JWT (expected three dot-separated segments).", file=sys.stderr)
+        sys.exit(2)
+
+    cfg = _require_guard_config()
+    api = _api_url(cfg)
+    ws = cfg.get("workspace_id") or cfg.get("workspace")
+    if not ws:
+        print("No workspace configured — run `conduct login` first.", file=sys.stderr)
+        sys.exit(2)
+
+    url = f"{api.rstrip('/')}/auth/whoami?workspace_id={ws}"
+    req = _ureq.Request(url, headers={
+        "Authorization": f"Bearer {jwt}",
+        "Accept": "application/json",
+        "User-Agent": "Conduct-Guard-Simulate/1.0",
+    })
+    print(f"[simulation] GET {url}")
+    try:
+        with _ureq.urlopen(req, timeout=15) as resp:
+            body = _json.loads(resp.read().decode("utf-8"))
+    except _uerr.HTTPError as e:
+        try:
+            detail = _json.loads(e.read().decode("utf-8"))
+        except Exception:
+            detail = {"detail": e.reason}
+        print(f"[simulation] HTTP {e.code}: {detail.get('detail', detail)}")
+        sys.exit(1)
+    except _uerr.URLError as e:
+        print(f"[simulation] connection failed: {e.reason}", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"[simulation] workspace: {body.get('workspace_id')}")
+    print(f"[simulation] token kind: {body.get('token_kind')}")
+    ident = body.get("identity")
+    if ident:
+        print(f"[simulation] identity   : {ident.get('name')} ({ident.get('source')}:{ident.get('source_id')})")
+        print(f"[simulation] lifecycle  : {ident.get('lifecycle_state')}")
+    else:
+        print("[simulation] identity   : (none — token did not resolve to an AgentIdentity)")
+
+
 def dispatch_guard(args, guard_p):
     """Dispatch to the correct guard handler. Called from main()."""
     guard_command = getattr(args, "guard_command", None)
@@ -3127,6 +3203,8 @@ def dispatch_guard(args, guard_p):
         cmd_guard_debug_hook(args)
     elif guard_command == "session":
         cmd_guard_session(args)
+    elif guard_command == "simulate":
+        cmd_guard_simulate(args)
     else:
         guard_p.print_help()
         sys.exit(1)

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/src/conduct_cli/hooks/pretooluse.py

@@ -299,6 +299,57 @@ def _bash_operator_signature(command: str) -> str:
     return " ; ".join(parts)
 
 
+# Flags whose value is prose meant for humans (issue bodies, commit messages,
+# PR descriptions, titles). Values here are excluded from pattern + decode
+# scanning so natural-language content does not trip pack regexes that were
+# only meant to catch CLI/env forms.
+_CONTENT_FLAGS = {
+    "--body", "--body-file", "-b",
+    "--message", "-m",
+    "--description", "-d",
+    "--title", "-t",
+    "--comment", "-c",
+    "--note",
+}
+
+
+def _bash_scan_target(command: str) -> str:
+    """Return command with content-flag values stripped, for pattern + decode scanning.
+
+    Preserves operator signature (argv, subcommands, flag names, paths, env
+    vars) so obfuscation-detection still works on the shell parts. Strips
+    only the prose-holding argument values that follow content flags.
+    """
+    if not command:
+        return ""
+    segments = re.split(r"&&|\|\||\|(?!\|)|;", command)
+    parts = []
+    for seg in segments:
+        try:
+            tokens = shlex.split(seg.strip())
+        except ValueError:
+            parts.append(seg.strip())
+            continue
+        keep = []
+        skip_next = False
+        for t in tokens:
+            if skip_next:
+                skip_next = False
+                continue
+            if t in _CONTENT_FLAGS:
+                keep.append(t)
+                skip_next = True
+                continue
+            if t.startswith("--") and "=" in t:
+                flag_name = t.split("=", 1)[0]
+                if flag_name in _CONTENT_FLAGS:
+                    keep.append(flag_name)
+                    continue
+            keep.append(t)
+        parts.append(" ".join(keep))
+    return " ; ".join(parts)
+
+
 # Framework rule prefixes known to false-positive on files that DEFINE, DOCUMENT,
 # or TEST security concepts. On paths under DEV_PATH_MARKERS these skip.
 # Fix for #1048. Prefix match rather than literal to avoid our own scanner triggers.
@@ -317,6 +368,14 @@ DOC_SENSITIVE_RULE_PREFIXES = (
     "proxy-no-prompt-" + "inject",
     "prompt-" + "inject",
     "nist-govern-" + "policy",
+    # Endpoint-attack pack (mirrors Numbat coverage). Rules match reverse
+    # shells, private-key reads, cloud metadata recon, persistence, etc. —
+    # patterns that would fire on the pack file itself when authoring it.
+    "endpoint-" + "attack",
+    # Filesystem-recon and network-egress rules fire on files that name
+    # credential paths, which is what the endpoint-attack pack does.
+    "no_" + "recon_fs",
+    "no_" + "network_egress",
 )
 
 # IRS regulatory pack rules also skip on dev paths since our own code names
@@ -330,9 +389,12 @@ DEV_PATH_MARKERS = (
     "/apps/api/tests/",
     "/apps/api/app/modules/agent_identity/",
     "/apps/api/app/modules/guard/cedar_adapter/",
+    "/apps/api/app/routers/",  # Conduct's own integration routers; still gated by sentinel
     # Removed /apps/web/src/ and /docs/ — too generic; those substrings appear
     # in ordinary Next.js apps and every project with a docs folder, which
     # would silently disable compliance rules in customer repos (#1049).
+    # /apps/api/app/routers/ kept because the sentinel gate prevents it
+    # from firing in customer repos that happen to share the subpath.
 )
 
 # Sentinel file at repo root marks a Conduct source repo — required for
@@ -493,7 +555,7 @@ def check_policy(tool_name: str, tool_input: dict, tokens_before: int = 0):
     rules = policy.get("rules", [])
     if tool_name == "Bash" and tool_input.get("command"):
         input_text = _bash_operator_signature(tool_input["command"])
-        raw_for_decode = tool_input["command"]
+        raw_for_decode = _bash_scan_target(tool_input["command"])
     else:
         input_text = json.dumps(tool_input)
         raw_for_decode = input_text
@@ -608,6 +670,80 @@ def _record_session_warn(session_id: str, rule_id: str) -> None:
 
 # ── Hook entrypoint ───────────────────────────────────────────────────────────
 
+
+def _guard_approval_request(
+    tool_name: str,
+    tool_input: dict,
+    rule_id: str,
+    message: str,
+    session_id: str | None,
+) -> str:
+    """Create a Guard approval request and long-poll for a decision.
+
+    Returns one of: "approved" | "rejected" | "timed_out" | "unavailable".
+    Fail-open on unavailable — the caller decides whether to allow (fail_open)
+    or block (fail_closed) based on Guard's configured fail mode."""
+    try:
+        cfg = load_config()
+        workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
+        agent_token  = cfg.get("agent_token", "")
+        api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
+        if not workspace_id or not agent_token:
+            return "unavailable"
+
+        body = json.dumps({
+            "rule_id":       rule_id or "unknown",
+            "rule_message":  message,
+            "tool_name":     tool_name,
+            "tool_input":    tool_input,
+            "surface":       "claude_code_hook",
+            "session_id":    session_id,
+        }).encode()
+        create_req = urllib.request.Request(
+            f"{api_url}/guard/approvals?workspace_id={workspace_id}",
+            data=body,
+            method="POST",
+            headers={
+                "Authorization": f"Bearer {agent_token}",
+                "Content-Type":  "application/json",
+                "X-Workspace-ID": workspace_id,
+            },
+        )
+        with urllib.request.urlopen(create_req, timeout=8) as resp:
+            created = json.loads(resp.read())
+        request_id = created.get("id")
+        url = created.get("url") or ""
+        if not request_id:
+            return "unavailable"
+
+        print(
+            f"[ConductGuard] PENDING approval - {message}\n"
+            f"  rule: {rule_id}\n"
+            f"  decide: {url}\n"
+            f"  waiting up to 5min for a decision...",
+            file=sys.stderr,
+        )
+
+        deadline = time.time() + 300
+        poll_url = f"{api_url}/guard/approvals/{request_id}?workspace_id={workspace_id}"
+        headers = {"Authorization": f"Bearer {agent_token}", "X-Workspace-ID": workspace_id}
+        while time.time() < deadline:
+            time.sleep(3.0)
+            try:
+                poll_req = urllib.request.Request(poll_url, headers=headers)
+                with urllib.request.urlopen(poll_req, timeout=5) as resp:
+                    row = json.loads(resp.read())
+                st = row.get("status", "pending")
+                if st in ("approved", "rejected", "timed_out"):
+                    return st
+            except Exception:
+                continue
+        return "timed_out"
+    except Exception as exc:
+        print(f"[ConductGuard] approval request failed: {exc}", file=sys.stderr)
+        return "unavailable"
+
+
 def main() -> None:
     try:
         data = json.load(sys.stdin)
@@ -673,7 +809,30 @@ def main() -> None:
         post_event(tool_name, tool_input, "audited", rule_id, f"[advisory] {message}", session_id, drain_via=_this_file)
         sys.exit(0)
 
-    decision = {"block": "blocked", "warn": "warned", "approval": "blocked"}.get(action, "allowed")
+    if action == "approval":
+        outcome = _guard_approval_request(tool_name, tool_input, rule_id, message, session_id)
+        if outcome == "approved":
+            post_event(tool_name, tool_input, "allowed", rule_id, f"[approval:approved] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval granted - proceeding.", file=sys.stderr)
+            sys.exit(0)
+        if outcome == "rejected":
+            post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:rejected] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval rejected - tool call blocked.", file=sys.stderr)
+            sys.exit(2)
+        if outcome == "timed_out":
+            post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:timed_out] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval timed out - tool call blocked.", file=sys.stderr)
+            sys.exit(2)
+        # unavailable - respect Guard's fail mode. Default fail-closed.
+        fail_mode = _get_fail_mode()
+        post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:unavailable/{fail_mode}] {message}", session_id, drain_via=_this_file)
+        if fail_mode == "fail_open":
+            print("[ConductGuard] approval service unavailable - fail-open allows.", file=sys.stderr)
+            sys.exit(0)
+        print("[ConductGuard] approval service unavailable - fail-closed blocks.", file=sys.stderr)
+        sys.exit(2)
+
+    decision = {"block": "blocked", "warn": "warned"}.get(action, "allowed")
     if action == "warn" and session_id and rule_id and _already_warned_this_session(session_id, rule_id):
         sys.exit(0)
     if action == "warn" and session_id and rule_id:
@@ -685,7 +844,7 @@ def main() -> None:
         print(msg)
         print(msg, file=sys.stderr)
         sys.exit(2)
-    if action in ("warn", "approval"):
+    if action == "warn":
         print(f"[ConductGuard] {message}")
 
     sys.exit(0)

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.0
+Version: 0.9.3
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.0 → conduct_cli-0.9.3}/src/conduct_cli.egg-info/SOURCES.txt

@@ -30,9 +30,12 @@ src/conduct_cli/hooks/stop.py
 tests/test_advisory_and_hook.py
 tests/test_api_client.py
 tests/test_bash_operator_signature.py
+tests/test_bash_scan_target.py
 tests/test_blast_radius.py
+tests/test_cli_matrix.py
 tests/test_cmd_run.py
 tests/test_command_word_matcher.py
+tests/test_conductguard_mcp_stdio.py
 tests/test_drain_daemon_health.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py

conduct_cli-0.9.3/tests/test_bash_scan_target.py

@@ -0,0 +1,141 @@
+"""Tests for _bash_scan_target — content-flag stripping for pattern scanning.
+
+Regression tests for the nist-govern-policy-bypass false-positive fix:
+prose inside --body / -m / --description / --title should NOT be scanned
+against pack regexes, but shell operators, subcommands, and non-content
+flag values must still be scanned so obfuscation-detection works.
+"""
+import re
+
+import pytest
+
+from conduct_cli.hooks.pretooluse import (
+    _bash_operator_signature,
+    _bash_scan_target,
+)
+
+
+class TestBashScanTargetContentStripping:
+    """Content-flag values must not appear in the scan target."""
+
+    def test_strips_gh_issue_body_prose(self):
+        cmd = 'gh issue create --title "T" --body "words that pack regex should NOT see"'
+        out = _bash_scan_target(cmd)
+        assert "words that pack regex" not in out
+        assert "--body" in out
+        assert "--title" in out
+        assert "gh issue create" in out
+
+    def test_strips_git_commit_message(self):
+        cmd = 'git commit -m "some prose that a pack regex should not match against"'
+        out = _bash_scan_target(cmd)
+        assert "some prose" not in out
+        assert "-m" in out
+        assert "git commit" in out
+
+    def test_strips_body_equals_form(self):
+        cmd = 'gh pr create --body="inline prose value"'
+        out = _bash_scan_target(cmd)
+        assert "inline prose value" not in out
+        assert "--body" in out
+
+    def test_strips_description_flag(self):
+        cmd = 'gh pr edit 42 --description "long description text"'
+        out = _bash_scan_target(cmd)
+        assert "long description" not in out
+        assert "--description" in out
+
+
+class TestBashScanTargetPreservesOperators:
+    """Shell operators and non-content flags must still be scannable."""
+
+    def test_preserves_argv_and_subcommand(self):
+        cmd = 'gh issue create --title "T" --body "prose"'
+        out = _bash_scan_target(cmd)
+        assert "gh" in out
+        assert "issue" in out
+        assert "create" in out
+
+    def test_preserves_pipe_chain_segments(self):
+        cmd = 'cat file.txt | grep foo && echo done'
+        out = _bash_scan_target(cmd)
+        assert "cat" in out
+        assert "file.txt" in out
+        assert "grep" in out
+        assert "echo" in out
+        assert "done" in out
+
+    def test_preserves_non_content_flag_values(self):
+        cmd = 'curl -H "X-Custom: value" https://example.com/api'
+        out = _bash_scan_target(cmd)
+        # -H is NOT a content flag, so its value stays
+        assert "X-Custom" in out or "value" in out
+        assert "https://example.com/api" in out
+
+
+class TestBashScanTargetEdgeCases:
+    def test_empty_command_returns_empty(self):
+        assert _bash_scan_target("") == ""
+        assert _bash_scan_target(None) == ""
+
+    def test_unparseable_segment_falls_back_to_raw(self):
+        # shlex can fail on unclosed quotes or heredocs; fallback must preserve
+        # the segment so obfuscation-detection still has something to scan.
+        cmd = 'echo "unclosed'
+        out = _bash_scan_target(cmd)
+        assert "echo" in out
+
+
+class TestNistGovernPolicyBypassRegression:
+    """The specific false-positive that motivated the fix.
+
+    Pack rule nist-govern-policy-bypass (conduct-nist-ai-rmf 1.0.1) should
+    NOT fire on prose bodies. Uses the NARROWED pattern from 1.0.1.
+    """
+
+    NARROWED_PATTERN = (
+        r"(--"
+        + "dis" + "able" + r"[- _]?"
+        + "pol" + "icy" + r"\b"
+        + r"|--no[- _]?"
+        + "pol" + "icy" + r"\b"
+        + r"|"
+        + "pol" + "icy_enabled" + r"\s*[:=]\s*(false|0|null|off)"
+        + r"|"
+        + "gov" + "ernance" + r"\s*[:=]\s*(false|0|null|off)"
+        + r"|GUARD_DISABLED\s*[:=]\s*(1|true)"
+        + r"|export\s+GUARD_DISABLED)"
+    )
+
+    def test_prose_bodies_do_not_match(self):
+        """The whole reason this fix exists."""
+        prose_commands = [
+            'gh issue create --body "deactivating a workflow should still enforce the workspace policy"',
+            'git commit -m "fix: stop expired tokens from bypassing the guard"',
+            'gh pr create --body "This PR narrows the pattern so it does not disable the policy scanner"',
+        ]
+        for cmd in prose_commands:
+            target = _bash_scan_target(cmd)
+            assert not re.search(self.NARROWED_PATTERN, target, re.IGNORECASE), (
+                f"False positive on prose: {cmd!r} produced scan target {target!r}"
+            )
+
+    def test_real_bypass_forms_still_match(self):
+        """Narrowing must not lose the security intent."""
+        bypass_commands = [
+            "conductguard --disable-policy",
+            "conductguard --no-policy",
+            "export GUARD_DISABLED=1",
+            "GUARD_DISABLED=true conductguard run",
+        ]
+        for cmd in bypass_commands:
+            target = _bash_scan_target(cmd)
+            assert re.search(self.NARROWED_PATTERN, target, re.IGNORECASE), (
+                f"Real bypass missed: {cmd!r} produced scan target {target!r}"
+            )
+
+
+if __name__ == "__main__":
+    # Runnable self-check per repo convention (ponytail: one runnable check)
+    import sys
+    sys.exit(pytest.main([__file__, "-v"]))

conduct_cli-0.9.3/tests/test_cli_matrix.py

@@ -0,0 +1,193 @@
+"""CLI command matrix — Phase 2 of the test-harness plan.
+
+Recursively discovers every `conduct` subcommand from `--help` output and
+parametrises three checks per command:
+
+  A. `--help` exits 0                       (import/parser wiring intact)
+  B. No arguments exits non-zero            (no command silently does nothing)
+  C. When it hits the API, it hits the URL  (auth boundary — CONDUCT_SERVER
+     override reaches a local 401 mock; assert we saw traffic OR the command
+     is on the OFFLINE_ONLY list)
+
+Every rung is auto-generated from the CLI itself — new subcommand added?
+Test picks it up. No hardcoded command list to drift.
+"""
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import socket
+import subprocess
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+
+CONDUCT = shutil.which("conduct") or "conduct"
+
+# Commands that intentionally do NOT touch the API (local ops only).
+# Kept small on purpose — add sparingly, with a comment.
+OFFLINE_ONLY: set[tuple[str, ...]] = {
+    ("login",),                    # opens browser, no direct API from CLI process
+    ("mcp", "install"),            # writes local Claude/Codex config
+    ("session-report",),           # scans local files
+    ("test-guard",),               # local synthetic events
+    ("test-security",),            # local synthetic findings
+    ("sessions",),                 # reads local Claude Code session directory
+    ("whoami",),                   # status query — prints config state, no API call when unauth'd
+    ("guard", "audit"),            # reads local ~/.conduct/audit.log
+    ("guard", "booster-status"),   # checks local booster install
+    ("guard", "discover"),         # scans local system for AI tools
+    ("guard", "install"),          # writes local hook + policy files
+    ("guard", "lint"),             # lints local policy YAML
+    ("guard", "savings"),          # reads local telemetry file
+    ("guard", "session", "start"), # local session state file
+    ("guard", "session", "stop"),  # local session state file
+    ("guard", "skip-setup"),       # writes local "skip" flag
+    ("guard", "status"),           # reads local guard config
+    ("guard", "watch"),            # local daemon
+}
+
+# Match `{a,b,c}` in the argparse "positional arguments:" section only.
+# Option choices like `--flag {yes,no}` and unrelated braces in help text
+# are ignored — that block is where argparse renders subparser groups.
+POSITIONAL_BLOCK_RE = re.compile(
+    r"positional arguments:\s*\n\s*\{([^\{\}]+)\}",
+    re.MULTILINE,
+)
+
+
+# ── Discovery ────────────────────────────────────────────────────────────────
+def _help(path: tuple[str, ...]) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [CONDUCT, *path, "--help"],
+        capture_output=True, text=True, timeout=15,
+    )
+
+
+def _subcommands_of(path: tuple[str, ...]) -> list[str]:
+    r = _help(path)
+    if r.returncode != 0:
+        return []
+    m = POSITIONAL_BLOCK_RE.search(r.stdout)
+    if not m:
+        return []
+    return [s.strip() for s in m.group(1).split(",") if s.strip()]
+
+
+def _walk(path: tuple[str, ...] = (), depth: int = 0, parent_children=()) -> list[tuple[str, ...]]:
+    # Depth cap: real tree is at most 3 deep (e.g. `guard session start`).
+    if depth > 3:
+        return []
+    out = [path] if path else []
+    children = _subcommands_of(path)
+    # `debug-hook <hook>` shows the same choice-list as `debug-hook` — argparse
+    # renders positional choices identically to subparser groups. Detect and stop.
+    if tuple(children) == parent_children:
+        return out
+    for child in children:
+        out.extend(_walk(path + (child,), depth + 1, tuple(children)))
+    return out
+
+
+try:
+    ALL_COMMANDS: list[tuple[str, ...]] = [p for p in _walk() if p]
+except (FileNotFoundError, subprocess.SubprocessError):
+    ALL_COMMANDS = []
+
+
+# ── Mock server ──────────────────────────────────────────────────────────────
+class _Recorder(BaseHTTPRequestHandler):
+    hits: list[str] = []
+
+    def do_GET(self): self._respond()
+    def do_POST(self): self._respond()
+    def do_PUT(self): self._respond()
+    def do_DELETE(self): self._respond()
+    def do_PATCH(self): self._respond()
+
+    def _respond(self):
+        _Recorder.hits.append(f"{self.command} {self.path}")
+        self.send_response(401)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(b'{"detail": "mock 401"}')
+
+    def log_message(self, *_):  # keep test output clean
+        pass
+
+
+@pytest.fixture(scope="module")
+def mock_server():
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    server = ThreadingHTTPServer(("127.0.0.1", port), _Recorder)
+    t = threading.Thread(target=server.serve_forever, daemon=True)
+    t.start()
+    yield f"http://127.0.0.1:{port}"
+    server.shutdown()
+
+
+# ── Tests ────────────────────────────────────────────────────────────────────
+def test_cli_installed():
+    assert CONDUCT and Path(CONDUCT).exists(), (
+        "`conduct` binary not on PATH — install with `pip install -e packages/conduct-cli`"
+    )
+
+
+def test_commands_discovered():
+    assert ALL_COMMANDS, "No subcommands discovered — CLI parser or --help broken"
+
+
+@pytest.mark.parametrize("cmd", ALL_COMMANDS, ids=[" ".join(c) for c in ALL_COMMANDS])
+def test_help_succeeds(cmd):
+    """Every command / subcommand must respond to --help with exit 0."""
+    r = _help(cmd)
+    assert r.returncode == 0, (
+        f'conduct {" ".join(cmd)} --help exited {r.returncode}\n'
+        f'stdout: {r.stdout[-400:]}\nstderr: {r.stderr[-400:]}'
+    )
+
+
+def _leaf_commands() -> list[tuple[str, ...]]:
+    """Only commands with NO sub-subcommands (actual invokable actions)."""
+    return [c for c in ALL_COMMANDS if not _subcommands_of(c)]
+
+
+LEAVES = _leaf_commands()
+
+
+@pytest.mark.matrix
+@pytest.mark.parametrize("cmd", LEAVES, ids=[" ".join(c) for c in LEAVES])
+def test_auth_boundary(cmd, mock_server, tmp_path, monkeypatch):
+    """No leaf command should complete cleanly against an unauthenticated
+    server. Either it hits the mock (proves it tried to auth) or it's on
+    OFFLINE_ONLY (proves we know it's local-only)."""
+    if cmd in OFFLINE_ONLY:
+        pytest.skip(f"{' '.join(cmd)} is documented as offline-only")
+
+    _Recorder.hits.clear()
+    env = os.environ.copy()
+    env.update({
+        "CONDUCT_SERVER": mock_server,
+        "HOME": str(tmp_path),                  # isolate ~/.conduct/config.json
+        "USERPROFILE": str(tmp_path),           # Windows equivalent
+        "CONDUCT_NON_INTERACTIVE": "1",
+        "NO_COLOR": "1",
+    })
+    r = subprocess.run(
+        [CONDUCT, *cmd],
+        capture_output=True, text=True, timeout=20, env=env,
+    )
+    hit_server = bool(_Recorder.hits)
+    exited_nonzero = r.returncode != 0
+
+    assert hit_server or exited_nonzero, (
+        f'conduct {" ".join(cmd)} exited 0 without touching the API — '
+        f'either it needs auth (bug) or add it to OFFLINE_ONLY.\n'
+        f'stdout: {r.stdout[-400:]}\nstderr: {r.stderr[-400:]}'
+    )

conduct_cli-0.9.3/tests/test_conductguard_mcp_stdio.py

@@ -0,0 +1,68 @@
+"""conductguard-mcp stdio smoke test — runs in cli-matrix on every OS x Python combo.
+
+Spawns the installed `conductguard-mcp` binary, sends `initialize` + `tools/list`
+over stdin, asserts the responses parse and expose the standard tool set. The
+CLI matrix would catch packaging regressions, stdio-loop crashes, or a broken
+initialize handshake that would otherwise only surface in Claude Desktop.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("conductguard-mcp") is None,
+    reason="conductguard-mcp not on PATH (install the package first)",
+)
+
+
+def _run(messages, timeout=8):
+    """Feed newline-delimited JSON-RPC messages, collect newline-delimited responses."""
+    payload = "\n".join(json.dumps(m) for m in messages) + "\n"
+    proc = subprocess.run(
+        ["conductguard-mcp", "--workspace", "00000000-0000-0000-0000-000000000000",
+         "--token", "dummy-for-stdio-smoke"],
+        input=payload,
+        capture_output=True,
+        text=True,
+        timeout=timeout,
+    )
+    lines = [ln for ln in proc.stdout.splitlines() if ln.strip()]
+    return proc, [json.loads(ln) for ln in lines]
+
+
+def test_initialize_returns_protocol_and_capabilities():
+    proc, replies = _run([
+        {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+         "params": {"protocolVersion": "2024-11-05", "clientInfo": {"name": "cli-matrix"}}},
+    ])
+    assert proc.returncode == 0, "conductguard-mcp exited " + str(proc.returncode) + ": " + proc.stderr[-400:]
+    assert len(replies) == 1
+    result = replies[0]["result"]
+    assert "protocolVersion" in result
+    assert "capabilities" in result and "tools" in result["capabilities"]
+
+
+def test_tools_list_exposes_guard_tools():
+    proc, replies = _run([
+        {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+         "params": {"protocolVersion": "2024-11-05", "clientInfo": {"name": "cli-matrix"}}},
+        {"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}},
+        {"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}},
+    ])
+    assert proc.returncode == 0
+    tool_lists = [r for r in replies if isinstance(r, dict) and r.get("id") == 2]
+    assert tool_lists, "no tools/list response found in: " + str(replies)
+    tools = tool_lists[0]["result"]["tools"]
+    names = {t["name"] for t in tools}
+    assert {"guard_check", "guard_activity"}.issubset(names), (
+        "expected the standard guard tool set, got: " + str(sorted(names))
+    )
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-v"]))