controlzero 1.13.1__tar.gz → 1.13.3__tar.gz

{controlzero-1.13.1 → controlzero-1.13.3}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 1.13.3 (2026-06-29): `verify --prove` enforcement-robustness layer
+
+### Added
+
+- **`controlzero verify --prove` actively PROVES enforcement instead of trusting
+  config.** Plain `verify` only checked that the hook config was present, so an
+  adapter could report green while its hooks never fired -- a "false-green"
+  install, the exact class behind the kiro-cli 2.10 and Codex hook-trust reports.
+  `--prove` runs a live probe that MUST be denied and confirms the governance hook
+  actually fired, reports the effective enforcement state, and validates against
+  per-adapter contract fixtures. Catches silent non-enforcement that config-only
+  checks miss.
+
+## 1.13.2 (2026-06-28): kiro-cli 2.10 install crash + cross-adapter hook hardening
+
+### Fixed
+
+- **kiro-cli Windows / non-UTF-8 install crash (Ken Lee report).** `controlzero
+  kiro init` captured kiro-cli's output in text mode using the OS locale codec, so
+  kiro-cli's UTF-8 output crashed the install's subprocess reader thread on
+  non-UTF-8 Windows locales (Korean CP949, Japanese SJIS, Chinese GBK). That crash
+  could leave the governance agent not set as default, so `kiro-cli chat` then ran
+  the built-in default agent ungoverned (no hooks, no audit). All kiro-cli
+  shell-outs now decode as UTF-8 (`errors="replace"`) and never crash the install.
+- **Codex hook-trust requirement surfaced at install.** Codex trust-gates the
+  non-managed `~/.codex/hooks.json` by hash and SKIPS it until trusted; the
+  installer now prints a loud ACTION-REQUIRED step (run `/hooks`, trust the Control
+  Zero hook, re-trust after every upgrade) instead of implying it enforces.
+- **Gemini defensive hooks gate.** The installer writes `hooksConfig.enabled=true`
+  so an admin/older build with hooks gated off does not silently run ungoverned.
+
+### Notes
+
+- kiro-cli 2.10 was verified live to FIRE embedded agent-config `preToolUse` hooks;
+  the canonical tool-name matchers (`execute_bash`/`fs_write`/`fs_read`/`use_aws`)
+  and the `"*"` all-tools token are correct on 2.10 (both new `shell` and legacy
+  `execute_bash` names match).
+
 ## 1.13.1 (2026-06-27): shell semantic-class enforcement
 
 ### Added

{controlzero-1.13.1 → controlzero-1.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.1
+Version: 1.13.3
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.1 → controlzero-1.13.3}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.1"
+__version__ = "1.13.3"
 
 __all__ = [
     "Client",

{controlzero-1.13.1 → controlzero-1.13.3}/controlzero/cli/doctor.py

@@ -457,6 +457,87 @@ def _check_antigravity_hook_live() -> List[Finding]:
     return findings
 
 
+# -----------------------------------------------------------------------------
+# Prove-enforcement live checks (R1 + R2) for the SAFE-NOW adapters.
+#
+# These generalize the Antigravity liveness check to every adapter via the
+# shared controlzero.cli.enforcement module: a pure offline EFFECTIVE-STATE
+# read (proves the AGENT will INVOKE our command -- gate on, hook trusted,
+# default agent set, failClosed present, the CZ block in the precedence-winning
+# layer) PLUS a real-deny PROBE through the EXACT installed command (proves the
+# command resolves and actually denies). "Present but not effective" => ERROR,
+# not a silent green. An adapter not configured on this box emits NO finding (a
+# valid state); doctor exit 1 stays reserved for active problems.
+# -----------------------------------------------------------------------------
+
+# Adapters that can be proven offline today (Phase A+B / SAFE-NOW). Antigravity
+# keeps its dedicated dry-run check above; codex trust is a WARN (needs-live).
+_PROVE_ADAPTERS = ("claude_code", "cursor", "gemini_cli", "codex_cli", "kiro")
+
+
+def _check_adapter_enforcement_live(adapter: str) -> List[Finding]:
+    """One prove-enforcement finding for an adapter (or none when it is not
+    installed on this box). ERROR when present-but-not-effective; WARN for
+    needs-live boundaries; silent when the adapter is absent."""
+    from controlzero.cli import enforcement
+
+    reader = enforcement.EFFECTIVE_STATE_READERS.get(adapter)
+    if reader is None:
+        return []
+    try:
+        state = reader()
+    except Exception:  # noqa: BLE001
+        return []
+    if not state.installed:
+        return []
+
+    findings: List[Finding] = []
+    path = state.config_path or adapter
+
+    if not state.ok:
+        findings.append(Finding(
+            path=path, line=1, col=1, severity="ERROR", code="E1010",
+            message=(
+                f"{adapter} hook is configured but NOT effectively enforcing: "
+                + "; ".join(state.red_reasons)
+            ),
+            fix_hint=f"run `controlzero install {adapter.replace('_', '-')}` and re-check `controlzero verify --prove`",
+        ))
+        # Still surface needs-live warns alongside the error.
+        for w in state.warns:
+            findings.append(Finding(
+                path=path, line=1, col=1, severity="WARN", code="E1011",
+                message=f"{adapter}: {w}", fix_hint="see `controlzero verify --prove` for the live signal",
+            ))
+        return findings
+
+    # Effective-state holds -> drive a real deny through the installed command.
+    installed_cmd = enforcement.installed_command(adapter)
+    contract = enforcement.ADAPTER_CONTRACTS.get(adapter)
+    if installed_cmd and contract is not None:
+        res = enforcement.run_enforcement_probe(
+            installed_cmd,
+            adapter=adapter,
+            decision_via_exit_code=(contract.block_mechanism != "stdout_decision"),
+        )
+        if not res.blocked:
+            findings.append(Finding(
+                path=path, line=1, col=1, severity="ERROR", code="E1012",
+                message=(
+                    f"{adapter} hook is wired but a real known-deny probe was NOT blocked "
+                    f"(exit={res.exit_code}{', error=' + res.error if res.error else ''}) -- "
+                    "the command does not resolve or does not enforce, tools run UNGOVERNED"
+                ),
+                fix_hint=f"reinstall (`controlzero install {adapter.replace('_', '-')}`); confirm the interpreter / PATH the hook resolves",
+            ))
+    for w in state.warns:
+        findings.append(Finding(
+            path=path, line=1, col=1, severity="WARN", code="E1011",
+            message=f"{adapter}: {w}", fix_hint="see `controlzero verify --prove` for the live signal",
+        ))
+    return findings
+
+
 # -----------------------------------------------------------------------------
 # Public entrypoint. Wired into the CLI as `controlzero doctor`.
 # -----------------------------------------------------------------------------
@@ -472,6 +553,8 @@ def run_doctor(verbose: bool = False) -> int:
     findings.extend(_check_config_permissions())
     findings.extend(_check_global_environment())
     findings.extend(_check_antigravity_hook_live())
+    for _adapter in _PROVE_ADAPTERS:
+        findings.extend(_check_adapter_enforcement_live(_adapter))
 
     errors = [f for f in findings if f.severity == "ERROR"]
     warns = [f for f in findings if f.severity == "WARN"]