conduct-cli 0.9.2__tar.gz → 0.9.3__tar.gz

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.2
+Version: 0.9.3
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "conduct-cli"
-version = "0.9.2"
+version = "0.9.3"
 description = "CLI for Conduct AI — secure, govern, install agents, manage projects, run tests"
 readme = "README.md"
 license = { text = "MIT" }

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/src/conduct_cli/guard.py

@@ -353,10 +353,10 @@ def _require_guard_config() -> dict:
     ws = cfg.get("workspace_id") or cfg.get("workspace")
     if not cfg or not ws:
         print(f"{RED}Guard not connected. Run: conduct login{RESET}", file=sys.stderr)
-        sys.exit(0)
+        sys.exit(1)
     if not cfg.get("agent_token"):
         print(f"{RED}Guard config is missing credentials. Run: conduct login{RESET}", file=sys.stderr)
-        sys.exit(0)
+        sys.exit(1)
     return cfg
 
 

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/src/conduct_cli/hooks/pretooluse.py

@@ -670,6 +670,80 @@ def _record_session_warn(session_id: str, rule_id: str) -> None:
 
 # ── Hook entrypoint ───────────────────────────────────────────────────────────
 
+
+def _guard_approval_request(
+    tool_name: str,
+    tool_input: dict,
+    rule_id: str,
+    message: str,
+    session_id: str | None,
+) -> str:
+    """Create a Guard approval request and long-poll for a decision.
+
+    Returns one of: "approved" | "rejected" | "timed_out" | "unavailable".
+    Fail-open on unavailable — the caller decides whether to allow (fail_open)
+    or block (fail_closed) based on Guard's configured fail mode."""
+    try:
+        cfg = load_config()
+        workspace_id = cfg.get("workspace_id") or cfg.get("workspace")
+        agent_token  = cfg.get("agent_token", "")
+        api_url      = cfg.get("api_url", "https://api.conductai.ai").rstrip("/")
+        if not workspace_id or not agent_token:
+            return "unavailable"
+
+        body = json.dumps({
+            "rule_id":       rule_id or "unknown",
+            "rule_message":  message,
+            "tool_name":     tool_name,
+            "tool_input":    tool_input,
+            "surface":       "claude_code_hook",
+            "session_id":    session_id,
+        }).encode()
+        create_req = urllib.request.Request(
+            f"{api_url}/guard/approvals?workspace_id={workspace_id}",
+            data=body,
+            method="POST",
+            headers={
+                "Authorization": f"Bearer {agent_token}",
+                "Content-Type":  "application/json",
+                "X-Workspace-ID": workspace_id,
+            },
+        )
+        with urllib.request.urlopen(create_req, timeout=8) as resp:
+            created = json.loads(resp.read())
+        request_id = created.get("id")
+        url = created.get("url") or ""
+        if not request_id:
+            return "unavailable"
+
+        print(
+            f"[ConductGuard] PENDING approval - {message}\n"
+            f"  rule: {rule_id}\n"
+            f"  decide: {url}\n"
+            f"  waiting up to 5min for a decision...",
+            file=sys.stderr,
+        )
+
+        deadline = time.time() + 300
+        poll_url = f"{api_url}/guard/approvals/{request_id}?workspace_id={workspace_id}"
+        headers = {"Authorization": f"Bearer {agent_token}", "X-Workspace-ID": workspace_id}
+        while time.time() < deadline:
+            time.sleep(3.0)
+            try:
+                poll_req = urllib.request.Request(poll_url, headers=headers)
+                with urllib.request.urlopen(poll_req, timeout=5) as resp:
+                    row = json.loads(resp.read())
+                st = row.get("status", "pending")
+                if st in ("approved", "rejected", "timed_out"):
+                    return st
+            except Exception:
+                continue
+        return "timed_out"
+    except Exception as exc:
+        print(f"[ConductGuard] approval request failed: {exc}", file=sys.stderr)
+        return "unavailable"
+
+
 def main() -> None:
     try:
         data = json.load(sys.stdin)
@@ -735,7 +809,30 @@ def main() -> None:
         post_event(tool_name, tool_input, "audited", rule_id, f"[advisory] {message}", session_id, drain_via=_this_file)
         sys.exit(0)
 
-    decision = {"block": "blocked", "warn": "warned", "approval": "blocked"}.get(action, "allowed")
+    if action == "approval":
+        outcome = _guard_approval_request(tool_name, tool_input, rule_id, message, session_id)
+        if outcome == "approved":
+            post_event(tool_name, tool_input, "allowed", rule_id, f"[approval:approved] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval granted - proceeding.", file=sys.stderr)
+            sys.exit(0)
+        if outcome == "rejected":
+            post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:rejected] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval rejected - tool call blocked.", file=sys.stderr)
+            sys.exit(2)
+        if outcome == "timed_out":
+            post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:timed_out] {message}", session_id, drain_via=_this_file)
+            print("[ConductGuard] approval timed out - tool call blocked.", file=sys.stderr)
+            sys.exit(2)
+        # unavailable - respect Guard's fail mode. Default fail-closed.
+        fail_mode = _get_fail_mode()
+        post_event(tool_name, tool_input, "blocked", rule_id, f"[approval:unavailable/{fail_mode}] {message}", session_id, drain_via=_this_file)
+        if fail_mode == "fail_open":
+            print("[ConductGuard] approval service unavailable - fail-open allows.", file=sys.stderr)
+            sys.exit(0)
+        print("[ConductGuard] approval service unavailable - fail-closed blocks.", file=sys.stderr)
+        sys.exit(2)
+
+    decision = {"block": "blocked", "warn": "warned"}.get(action, "allowed")
     if action == "warn" and session_id and rule_id and _already_warned_this_session(session_id, rule_id):
         sys.exit(0)
     if action == "warn" and session_id and rule_id:
@@ -747,7 +844,7 @@ def main() -> None:
         print(msg)
         print(msg, file=sys.stderr)
         sys.exit(2)
-    if action in ("warn", "approval"):
+    if action == "warn":
         print(f"[ConductGuard] {message}")
 
     sys.exit(0)

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/src/conduct_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: conduct-cli
-Version: 0.9.2
+Version: 0.9.3
 Summary: CLI for Conduct AI — secure, govern, install agents, manage projects, run tests
 Author-email: Conduct AI <hello@conductai.ai>
 License: MIT

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/src/conduct_cli.egg-info/SOURCES.txt

@@ -35,6 +35,7 @@ tests/test_blast_radius.py
 tests/test_cli_matrix.py
 tests/test_cmd_run.py
 tests/test_command_word_matcher.py
+tests/test_conductguard_mcp_stdio.py
 tests/test_drain_daemon_health.py
 tests/test_guard_policy.py
 tests/test_guard_savings.py

{conduct_cli-0.9.2 → conduct_cli-0.9.3}/tests/test_cli_matrix.py

@@ -30,11 +30,24 @@ CONDUCT = shutil.which("conduct") or "conduct"
 # Commands that intentionally do NOT touch the API (local ops only).
 # Kept small on purpose — add sparingly, with a comment.
 OFFLINE_ONLY: set[tuple[str, ...]] = {
-    ("login",),               # opens browser, no direct API from CLI process
-    ("mcp", "install"),       # writes local Claude/Codex config
-    ("session-report",),      # scans local files
-    ("test-guard",),          # local synthetic events
-    ("test-security",),       # local synthetic findings
+    ("login",),                    # opens browser, no direct API from CLI process
+    ("mcp", "install"),            # writes local Claude/Codex config
+    ("session-report",),           # scans local files
+    ("test-guard",),               # local synthetic events
+    ("test-security",),            # local synthetic findings
+    ("sessions",),                 # reads local Claude Code session directory
+    ("whoami",),                   # status query — prints config state, no API call when unauth'd
+    ("guard", "audit"),            # reads local ~/.conduct/audit.log
+    ("guard", "booster-status"),   # checks local booster install
+    ("guard", "discover"),         # scans local system for AI tools
+    ("guard", "install"),          # writes local hook + policy files
+    ("guard", "lint"),             # lints local policy YAML
+    ("guard", "savings"),          # reads local telemetry file
+    ("guard", "session", "start"), # local session state file
+    ("guard", "session", "stop"),  # local session state file
+    ("guard", "skip-setup"),       # writes local "skip" flag
+    ("guard", "status"),           # reads local guard config
+    ("guard", "watch"),            # local daemon
 }
 
 # Match `{a,b,c}` in the argparse "positional arguments:" section only.

conduct_cli-0.9.3/tests/test_conductguard_mcp_stdio.py

@@ -0,0 +1,68 @@
+"""conductguard-mcp stdio smoke test — runs in cli-matrix on every OS x Python combo.
+
+Spawns the installed `conductguard-mcp` binary, sends `initialize` + `tools/list`
+over stdin, asserts the responses parse and expose the standard tool set. The
+CLI matrix would catch packaging regressions, stdio-loop crashes, or a broken
+initialize handshake that would otherwise only surface in Claude Desktop.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("conductguard-mcp") is None,
+    reason="conductguard-mcp not on PATH (install the package first)",
+)
+
+
+def _run(messages, timeout=8):
+    """Feed newline-delimited JSON-RPC messages, collect newline-delimited responses."""
+    payload = "\n".join(json.dumps(m) for m in messages) + "\n"
+    proc = subprocess.run(
+        ["conductguard-mcp", "--workspace", "00000000-0000-0000-0000-000000000000",
+         "--token", "dummy-for-stdio-smoke"],
+        input=payload,
+        capture_output=True,
+        text=True,
+        timeout=timeout,
+    )
+    lines = [ln for ln in proc.stdout.splitlines() if ln.strip()]
+    return proc, [json.loads(ln) for ln in lines]
+
+
+def test_initialize_returns_protocol_and_capabilities():
+    proc, replies = _run([
+        {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+         "params": {"protocolVersion": "2024-11-05", "clientInfo": {"name": "cli-matrix"}}},
+    ])
+    assert proc.returncode == 0, "conductguard-mcp exited " + str(proc.returncode) + ": " + proc.stderr[-400:]
+    assert len(replies) == 1
+    result = replies[0]["result"]
+    assert "protocolVersion" in result
+    assert "capabilities" in result and "tools" in result["capabilities"]
+
+
+def test_tools_list_exposes_guard_tools():
+    proc, replies = _run([
+        {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+         "params": {"protocolVersion": "2024-11-05", "clientInfo": {"name": "cli-matrix"}}},
+        {"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}},
+        {"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}},
+    ])
+    assert proc.returncode == 0
+    tool_lists = [r for r in replies if isinstance(r, dict) and r.get("id") == 2]
+    assert tool_lists, "no tools/list response found in: " + str(replies)
+    tools = tool_lists[0]["result"]["tools"]
+    names = {t["name"] for t in tools}
+    assert {"guard_check", "guard_activity"}.issubset(names), (
+        "expected the standard guard tool set, got: " + str(sorted(names))
+    )
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-v"]))