controlzero 1.13.3__tar.gz → 1.13.5__tar.gz

{controlzero-1.13.3 → controlzero-1.13.5}/.gitignore

@@ -70,7 +70,6 @@ firebase-service-account*.json
 firebase-adminsdk-*.json
 serviceAccountKey.json
 cz-service-account.json
-firebase-credentials.json/
 google-services.json
 GoogleService-Info.plist
 !*.pub
@@ -261,3 +260,7 @@ doc_local/
 
 # Antigravity (agy) CLI local workspace
 .antigravitycli/
+
+# HITL canary local config (never commit secrets)
+hitl-canary.env
+*.canary.env

{controlzero-1.13.3 → controlzero-1.13.5}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.13.4 (2026-07-05): deny-wins fail-open fix (P0)
+
+### Fixed
+
+- **Explicit deny now wins -- a default allow-* no longer shadows an attached
+  deny (#1623/#1620).** The bundle translator sorted policies by `priority`
+  ASCENDING, so a priority-0 catch-all `allow-*` was evaluated before a
+  higher-priority attached `deny`, and a denied action (e.g. `rm -rf`) fell
+  OPEN. The translator now sorts DESCENDING (higher priority first), matching
+  the server-side policy engine, so an explicit deny is honored. This is the
+  hard gate for the fail-open reported on 1.13.3 and below.
+
+### Notes
+
+- The backend now stamps `min_sdk_version = 1.13.4` on any bundle containing a
+  deny rule, so an SDK below 1.13.4 fails CLOSED (`BundleRequiresNewerSDKError`,
+  E1712) rather than silently under-enforcing. Upgrade to 1.13.4 to keep deny
+  rules enforced.
+
 ## 1.13.3 (2026-06-29): `verify --prove` enforcement-robustness layer
 
 ### Added
@@ -181,7 +200,7 @@
   server-side before persist (#1433), and captured payloads are sealed under a
   per-record DEK.
 
-- **DLP `mask` action enforced in the SDK (#1278 kakaopay checklist #6).**
+- **DLP `mask` action enforced in the SDK (#1278 acme checklist #6).**
   The `mask` action now redacts matched sensitive spans in the tool arguments
   (modify-and-proceed) instead of only being recorded as a finding. When a DLP
   rule matches with `action="mask"` on an `allow` decision, the enforcer

{controlzero-1.13.3 → controlzero-1.13.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.3
+Version: 1.13.5
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.3"
+__version__ = "1.13.5"
 
 __all__ = [
     "Client",

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/_internal/action_validator.py

@@ -39,6 +39,7 @@ _CANONICAL_TOOLS: set[str] = {
     # Bash aliases
     "bash", "shell", "ShellTool", "run_shell_command",
     "PowerShell", "powershell", "Shell",
+    "execute_bash", "local_shell", "run_terminal_cmd",
     # http aliases
     "fetch", "web_fetch", "WebFetch", "HTTPRequest", "request",
     # web_search aliases

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/_internal/bundle.py

@@ -430,37 +430,138 @@ def _parse_version_tuple(v: str) -> tuple:
     return tuple(nums) + (1, "")
 
 
-def check_min_sdk_version(payload: dict, sdk_version: str) -> None:
-    """Raise :class:`BundleRequiresNewerSDKError` if the bundle
-    declares a higher floor than ``sdk_version``.
-
-    Bundles without ``metadata.min_sdk_version`` are accepted
-    unconditionally (back-compat: every bundle minted before #602
-    omits the field).
-
-    No-op fast path covers 99% of bundles in the field, so the
-    cost is one ``.get("metadata", {}).get("min_sdk_version")``
-    indirection per load.
+def sdk_below_floor(payload: dict, sdk_version: str) -> Optional[tuple[str, str]]:
+    """Return ``(required, actual)`` when ``sdk_version`` is BELOW the bundle's
+    ``metadata.min_sdk_version`` floor, else ``None``.
+
+    The floor is stamped by the backend as the MAX over every min-SDK floor the
+    bundle's rules require -- the #602 selector floor AND the capability floors
+    (any deny rule -> 1.13.4, any tagged {op,value} condition -> 1.13.0). An SDK
+    below the floor SILENTLY MIS-ENFORCES those rules (the confirmed #1011 rm-rf
+    fail-open on a stale 1.12.0), so the caller must fail loud/closed rather than
+    under-enforce.
+
+    Bundles without ``metadata.min_sdk_version`` return ``None`` (back-compat:
+    every bundle minted before #602 omits the field). No-op fast path covers
+    99% of bundles in the field.
     """
     metadata = payload.get("metadata")
     if not isinstance(metadata, dict):
-        return
+        return None
     required = metadata.get("min_sdk_version")
     if not isinstance(required, str) or not required:
+        return None
+    if _parse_version_tuple(sdk_version) >= _parse_version_tuple(required):
+        return None
+    return required, sdk_version
+
+
+def check_min_sdk_version(payload: dict, sdk_version: str) -> None:
+    """Raise :class:`BundleRequiresNewerSDKError` if the bundle declares a
+    higher floor than ``sdk_version``.
+
+    This is the low-level HARD-refusal predicate, kept for direct callers and
+    back-compat. The hosted load path does NOT call this directly -- it uses
+    :func:`sdk_below_floor` + posture (see hosted_policy) so an allow-by-default
+    bundle degrades-with-a-loud-warning instead of hard-refusing, while a
+    deny-by-default bundle fails closed.
+    """
+    below = sdk_below_floor(payload, sdk_version)
+    if below is None:
         return
+    required, actual = below
     # Lazy import: errors -> _internal cycle is avoided because
     # this is invoked at runtime, after both modules finished loading.
     from controlzero.errors import BundleRequiresNewerSDKError
 
-    if _parse_version_tuple(sdk_version) >= _parse_version_tuple(required):
-        return
     raise BundleRequiresNewerSDKError(
         required=required,
-        actual=sdk_version,
+        actual=actual,
         upgrade_command="pip install -U controlzero",
     )
 
 
+# Canonical upgrade command surfaced in every below-floor message. Per-language
+# (mirrors BundleRequiresNewerSDKError.upgrade_command); the reason_code and
+# enforcement_status are the byte-identical cross-SDK fields.
+SDK_UPGRADE_COMMAND = "pip install -U controlzero"
+
+
+def below_floor_deny_reason(required: str, actual: str, upgrade_command: str) -> str:
+    """User-facing reason on a fail-closed deny caused by an under-floor SDK."""
+    return (
+        f"[Control Zero] Your SDK {actual} is below the minimum {required} this "
+        f"policy requires. Enforcement cannot be guaranteed -- blocking as a "
+        f"precaution (deny-by-default posture). Upgrade to restore enforcement: "
+        f"{upgrade_command}"
+    )
+
+
+def below_floor_degraded_warning(required: str, actual: str, upgrade_command: str) -> str:
+    """Loud stderr banner when an under-floor SDK ALLOWS under an allow/observe
+    posture -- enforcement is degraded, never silent."""
+    return (
+        f"[Control Zero] ENFORCEMENT DEGRADED: your SDK {actual} is below the "
+        f"minimum {required} this policy requires (allow-by-default posture) -- "
+        f"this policy's deny rules may NOT be applied. Upgrade to restore "
+        f"enforcement: {upgrade_command}"
+    )
+
+
+def make_below_floor_policy(
+    required: str,
+    actual: str,
+    upgrade_command: str = SDK_UPGRADE_COMMAND,
+) -> dict:
+    """Build the synthetic deny-all local-policy used when a deny-by-default
+    bundle is loaded by an SDK BELOW its min_sdk_version floor.
+
+    Same shape as :func:`translate_to_local_policy` so downstream
+    :func:`controlzero.policy_loader.load_policy` accepts it unchanged. Every
+    tool call is denied with reason_code ``SDK_BELOW_FLOOR`` and
+    ``settings.enforcement_status = "fail_closed"`` -- the drift is loud on
+    every audit row, never a silent under-enforce.
+    """
+    return {
+        "version": "1",
+        "rules": [
+            {
+                "effect": "deny",
+                "action": "*",
+                "id": "synthetic:SDK_BELOW_FLOOR",
+                "reason": below_floor_deny_reason(required, actual, upgrade_command),
+                "reason_code": "SDK_BELOW_FLOOR",
+            }
+        ],
+        "settings": {
+            "default_action": "deny",
+            "default_on_missing": "deny",
+            "default_on_tamper": "warn",
+            "enforcement_status": "fail_closed",
+        },
+    }
+
+
+def bundle_is_deny_posture(payload: dict) -> bool:
+    """Whether the bundle's resolved default posture is deny-by-default.
+
+    Used ONLY to decide the below-floor behaviour: a deny-by-default bundle
+    fails CLOSED (deny-all) when the SDK is under the floor; an allow/observe
+    bundle degrades-with-a-loud-warning (the #1011 case: allow-by-default + stale
+    SDK must scream, not silently allow). Missing / unknown default_action
+    coerces to the canonical ``deny`` -- the safe direction.
+    """
+    from controlzero._internal.enforcer import (
+        DEFAULT_BUNDLE_ACTION,
+        VALID_DEFAULT_ACTIONS,
+    )
+
+    da = payload.get("default_action")
+    if da not in VALID_DEFAULT_ACTIONS:
+        da = DEFAULT_BUNDLE_ACTION
+    return da == "deny"
+
+
 # --- Schema translation ----------------------------------------------------
 
 
@@ -521,8 +622,14 @@ def translate_to_local_policy(
     either ``{"deny": "<tool>"}``, ``{"allow": "<tool>"}`` or
     ``{"effect": "<deny|allow|warn|audit>", "action": "<tool>"}``.
 
-    Policies are sorted by ``priority`` ascending so SDKs in every
-    language produce identical decisions from identical input.
+    Policies are sorted by ``priority`` DESCENDING (higher number = higher
+    precedence = evaluated first; first-match-wins), so SDKs in every language
+    -- and the policy engine, which already sorts descending -- produce
+    identical decisions from identical input (#1620 cross-engine parity). The
+    auto-attached onboarding "Default policy" catch-all is pinned to the lowest
+    priority (``math.MinInt32``) by the backend, so it sorts LAST and never
+    shadows a user-attached deny. (Before #1620 this sort was ASCENDING, which
+    put the priority-0 default catch-all FIRST -- the core-promise fail-open.)
 
     Schema 1.1 (#228 Phase 2) adds three top-level enforcement-default
     knobs -- ``default_action``, ``default_on_missing``, and
@@ -580,9 +687,13 @@ def translate_to_local_policy(
     # latter must fail CLOSED, never observe-allow.
     raw_policies = payload.get("policies")
     policies = raw_policies or []
+    # DESCENDING (#1620): higher priority evaluated first, matching the policy
+    # engine. `sorted` is stable, so equal-priority policies keep the backend's
+    # emit order (which already places the catch-all last within its tier).
     policies = sorted(
         [p for p in policies if isinstance(p, dict)],
         key=lambda p: int(p.get("priority", 100)),
+        reverse=True,
     )
 
     flat: list[dict] = []

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/_internal/enforcer.py

@@ -107,6 +107,14 @@ REASON_CODE_HITL_IDENTITY_NOT_IN_ORG = "HITL_IDENTITY_NOT_IN_ORG"
 REASON_CODE_HITL_IDENTITY_REQUIRED = "HITL_IDENTITY_REQUIRED"
 REASON_CODE_HITL_IDENTITY_CLAIM_REJECTED = "HITL_IDENTITY_CLAIM_REJECTED"
 REASON_CODE_HITL_ARGS_HASH_MISMATCH = "HITL_ARGS_HASH_MISMATCH"
+# Version-aware fail-closed enforcement (the #1011 stale-SDK fail-open). Stamped
+# when the running SDK is BELOW the bundle's metadata.min_sdk_version -- the
+# floor the backend derives from the rule capabilities the bundle uses (deny
+# rules / condition operators). On a deny-by-default posture the SDK fails
+# CLOSED with this code; on allow/observe posture it allows but flags every row
+# with enforcement_status=degraded_below_floor. Either way the drift is VISIBLE,
+# never a silent under-enforce.
+REASON_CODE_SDK_BELOW_FLOOR = "SDK_BELOW_FLOOR"
 
 VALID_REASON_CODES = frozenset({
     REASON_CODE_RULE_MATCH,
@@ -128,6 +136,24 @@ VALID_REASON_CODES = frozenset({
     REASON_CODE_HITL_IDENTITY_REQUIRED,
     REASON_CODE_HITL_IDENTITY_CLAIM_REJECTED,
     REASON_CODE_HITL_ARGS_HASH_MISMATCH,
+    REASON_CODE_SDK_BELOW_FLOOR,
+})
+
+# Enforcement status (version-aware fail-closed telemetry). A per-decision
+# machine-readable summary of WHETHER the SDK is actually enforcing, surfaced on
+# the audit/telemetry wire so the dashboard can show, per connected machine,
+# green (enforcing) vs a degraded/fail-closed banner. Absent on the wire ==
+# "enforcing" (lean additive contract). Kept in lockstep across all three SDKs.
+ENFORCEMENT_STATUS_ENFORCING = "enforcing"
+ENFORCEMENT_STATUS_DEGRADED_BELOW_FLOOR = "degraded_below_floor"
+ENFORCEMENT_STATUS_FAIL_CLOSED = "fail_closed"
+ENFORCEMENT_STATUS_BUNDLE_MISSING = "bundle_missing"
+
+VALID_ENFORCEMENT_STATUSES = frozenset({
+    ENFORCEMENT_STATUS_ENFORCING,
+    ENFORCEMENT_STATUS_DEGRADED_BELOW_FLOOR,
+    ENFORCEMENT_STATUS_FAIL_CLOSED,
+    ENFORCEMENT_STATUS_BUNDLE_MISSING,
 })
 
 # Synthetic policy_id sentinels (T79 / the deny-deny postmortem,
@@ -158,6 +184,10 @@ SYNTHETIC_ENGINE_UNAVAILABLE = "synthetic:ENGINE_UNAVAILABLE"
 # policy_id -- e.g. an old field SDK or a CLI fail-closed path. SDKs do not
 # emit it; it is listed here so downstream consumers recognize it.
 SYNTHETIC_UNATTRIBUTED_DENY = "synthetic:UNATTRIBUTED_DENY"
+# Version-aware fail-closed: the deny-all synthetic policy_id stamped on every
+# row when a deny-posture bundle is loaded by an SDK BELOW its min_sdk_version
+# floor. Pairs with reason_code=SDK_BELOW_FLOOR.
+SYNTHETIC_SDK_BELOW_FLOOR = "synthetic:SDK_BELOW_FLOOR"
 
 VALID_SYNTHETIC_POLICY_IDS = frozenset({
     SYNTHETIC_NO_RULE_MATCH,
@@ -168,6 +198,7 @@ VALID_SYNTHETIC_POLICY_IDS = frozenset({
     SYNTHETIC_QUARANTINE,
     SYNTHETIC_ENGINE_UNAVAILABLE,
     SYNTHETIC_UNATTRIBUTED_DENY,
+    SYNTHETIC_SDK_BELOW_FLOOR,
 })
 
 # Canonical bundle-level default values. These must stay in lockstep

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/_internal/tool_extractors.json

@@ -20,7 +20,10 @@
         "run_command",
         "PowerShell",
         "powershell",
-        "Shell"
+        "Shell",
+        "execute_bash",
+        "local_shell",
+        "run_terminal_cmd"
       ]
     },
     "http": {

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/audit_remote.py

@@ -454,6 +454,29 @@ def _build_wire_entry(
         if entry.get(key) is True:
             wire[key] = True
 
+    # Version-aware fail-closed telemetry (#1011). enforcement_status is the
+    # per-decision "is this machine actually enforcing" summary (fail_closed /
+    # degraded_below_floor / bundle_missing); client_version above already
+    # carries the running SDK version. bundle_age_s + last_sync_ts (bundle
+    # freshness) are forwarded when the caller supplies them. Each is emitted
+    # ONLY when present so the common enforcing row stays byte-identical
+    # (absent enforcement_status == "enforcing"); older backends ignore the
+    # additive keys. This is the exact wire shape the machines/agents dashboard
+    # consumes to show per-machine SDK version + bundle age + enforcement state.
+    _enf = entry.get("enforcement_status")
+    if _enf:
+        wire["enforcement_status"] = str(_enf)
+    for _fresh_key in ("bundle_age_s", "last_sync_ts"):
+        _fv = entry.get(_fresh_key)
+        if _fv is None:
+            continue
+        try:
+            _fn = float(_fv)
+        except (TypeError, ValueError, OverflowError):
+            continue
+        if math.isfinite(_fn) and _fn >= 0:
+            wire[_fresh_key] = int(_fn)
+
     # Final batch-poison backstop (#439 codex P1-b): every value that goes on
     # the wire -- including the raw top-level forwarded fields above (the
     # credential_* envelope copies entry[key] verbatim) and any future field

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/cli/agent_config.py

@@ -180,7 +180,7 @@ def per_agent_api_key(
     ONLY the per-agent ``integrations/<canonical_source>/config.yaml`` key, or
     None. hook-check uses it to make a surface's installed key AUTHORITATIVE
     over a stale ambient ``CONTROLZERO_API_KEY`` (#1011 follow-up): a surface
-    wired by ``install <agent> --api-key`` / ``kiro init --api-key`` must
+    wired by ``install <agent> --api-key`` (e.g. ``install kiro --api-key``) must
     attribute its audit to the project it was installed for, never to whatever
     key happens to be exported in the shell. Never raises.
     """

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/cli/hosts/codex_cli.py

@@ -35,6 +35,15 @@ from controlzero.cli.hosts.base import CoverageDecl, CZDecision, HostAdapter
 # fail-open backstop).
 _CODEX_CLI_CLIENTS = ("codex-cli", "codex_cli", "codex")
 
+# Kiro CLI v3 is built on the Codex codebase and exports CODEX_HOME/CODEX_CLI.
+# Its hooks send camelCase hook_event_name values (preToolUse, postToolUse,
+# userPromptSubmit) -- byte-disjoint from Codex's PascalCase (PreToolUse).
+# When we see a camelCase event, defer to KiroCLIAdapter rather than claiming
+# the call based on CODEX_HOME/CODEX_CLI env hints alone (Bug #1655).
+_KIRO_CLI_CAMEL_EVENTS = frozenset(
+    {"preToolUse", "postToolUse", "userPromptSubmit", "agentSpawn", "stop"}
+)
+
 
 class CodexCLIAdapter(HostAdapter):
     name = "codex_cli"
@@ -66,6 +75,12 @@ class CodexCLIAdapter(HostAdapter):
         # pinned host's adapter (not this one) claims the call.
         if self._pinned_elsewhere(env, _CODEX_CLI_CLIENTS):
             return False
+        # Kiro CLI exports CODEX_HOME/CODEX_CLI (built on Codex codebase) but
+        # sends camelCase hook_event_name values (preToolUse vs Codex's
+        # PascalCase PreToolUse). Defer to KiroCLIAdapter when we see a
+        # camelCase Kiro event so audit logs show "kiro_cli" not "codex_cli".
+        if isinstance(payload, dict) and payload.get("hook_event_name") in _KIRO_CLI_CAMEL_EVENTS:
+            return False
         for hint in self._ENV_HINTS:
             if env.get(hint):
                 return True

{controlzero-1.13.3 → controlzero-1.13.5}/controlzero/cli/kiro_adapter.py

@@ -13,7 +13,7 @@ IDE surface, NOT the Kiro CLI's ``userPromptSubmit``), e.g.::
 
     cz-kiro-adapter preToolUse
 
-This module is the packaged entry point: ``controlzero kiro init`` wires the
+This module is the packaged entry point: ``controlzero install kiro`` wires the
 IDE hooks to the ``cz-kiro-adapter`` console script declared in pyproject, so
 it resolves on PATH after ``pip install controlzero`` with no separate copy
 step. The repository ``tools/cz-kiro-adapter`` script delegates here so dev
@@ -134,9 +134,17 @@ def main(argv: list[str] | None = None) -> int:
                 file=sys.stderr,
             )
             return 0
+        # Upstream Kiro IDE bug #7375/#7408/#7500: preToolUse hooks receive
+        # USER_PROMPT={} with no tool context. The 'Control Zero - Pre Tool Use'
+        # hook in Kiro IDE settings ships DISABLED to prevent this. If you are
+        # seeing this message, you have enabled that hook. Disable it in Kiro
+        # IDE Settings > Hooks to restore normal tool execution.
         print(
-            "controlzero(kiro): empty/unparseable IDE payload; blocking "
-            "(fail-closed; set CZ_KIRO_UNKNOWN_PAYLOAD=open to override)",
+            f"controlzero(kiro): {event} hook received empty payload "
+            "(upstream Kiro IDE bug #7375/#7408/#7500 -- preToolUse delivers "
+            "USER_PROMPT={}). Failing closed. FIX: disable the "
+            "'Control Zero - Pre Tool Use' hook in Kiro IDE Settings > Hooks. "
+            "Set CZ_KIRO_UNKNOWN_PAYLOAD=open in the hook env to allow instead.",
             file=sys.stderr,
         )
         return 2