controlzero 1.13.4__tar.gz → 1.13.5__tar.gz

{controlzero-1.13.4 → controlzero-1.13.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.4
+Version: 1.13.5
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.4 → controlzero-1.13.5}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.4"
+__version__ = "1.13.5"
 
 __all__ = [
     "Client",

{controlzero-1.13.4 → controlzero-1.13.5}/controlzero/cli/hosts/codex_cli.py

@@ -35,6 +35,15 @@ from controlzero.cli.hosts.base import CoverageDecl, CZDecision, HostAdapter
 # fail-open backstop).
 _CODEX_CLI_CLIENTS = ("codex-cli", "codex_cli", "codex")
 
+# Kiro CLI v3 is built on the Codex codebase and exports CODEX_HOME/CODEX_CLI.
+# Its hooks send camelCase hook_event_name values (preToolUse, postToolUse,
+# userPromptSubmit) -- byte-disjoint from Codex's PascalCase (PreToolUse).
+# When we see a camelCase event, defer to KiroCLIAdapter rather than claiming
+# the call based on CODEX_HOME/CODEX_CLI env hints alone (Bug #1655).
+_KIRO_CLI_CAMEL_EVENTS = frozenset(
+    {"preToolUse", "postToolUse", "userPromptSubmit", "agentSpawn", "stop"}
+)
+
 
 class CodexCLIAdapter(HostAdapter):
     name = "codex_cli"
@@ -66,6 +75,12 @@ class CodexCLIAdapter(HostAdapter):
         # pinned host's adapter (not this one) claims the call.
         if self._pinned_elsewhere(env, _CODEX_CLI_CLIENTS):
             return False
+        # Kiro CLI exports CODEX_HOME/CODEX_CLI (built on Codex codebase) but
+        # sends camelCase hook_event_name values (preToolUse vs Codex's
+        # PascalCase PreToolUse). Defer to KiroCLIAdapter when we see a
+        # camelCase Kiro event so audit logs show "kiro_cli" not "codex_cli".
+        if isinstance(payload, dict) and payload.get("hook_event_name") in _KIRO_CLI_CAMEL_EVENTS:
+            return False
         for hint in self._ENV_HINTS:
             if env.get(hint):
                 return True

{controlzero-1.13.4 → controlzero-1.13.5}/controlzero/cli/kiro_adapter.py

@@ -134,9 +134,17 @@ def main(argv: list[str] | None = None) -> int:
                 file=sys.stderr,
             )
             return 0
+        # Upstream Kiro IDE bug #7375/#7408/#7500: preToolUse hooks receive
+        # USER_PROMPT={} with no tool context. The 'Control Zero - Pre Tool Use'
+        # hook in Kiro IDE settings ships DISABLED to prevent this. If you are
+        # seeing this message, you have enabled that hook. Disable it in Kiro
+        # IDE Settings > Hooks to restore normal tool execution.
         print(
-            "controlzero(kiro): empty/unparseable IDE payload; blocking "
-            "(fail-closed; set CZ_KIRO_UNKNOWN_PAYLOAD=open to override)",
+            f"controlzero(kiro): {event} hook received empty payload "
+            "(upstream Kiro IDE bug #7375/#7408/#7500 -- preToolUse delivers "
+            "USER_PROMPT={}). Failing closed. FIX: disable the "
+            "'Control Zero - Pre Tool Use' hook in Kiro IDE Settings > Hooks. "
+            "Set CZ_KIRO_UNKNOWN_PAYLOAD=open in the hook env to allow instead.",
             file=sys.stderr,
         )
         return 2

controlzero-1.13.5/controlzero/cli/templates/kiro/ide-pre-tool-use.kiro.hook

@@ -0,0 +1,15 @@
+{
+  "enabled": false,
+  "name": "Control Zero - Pre Tool Use [DO NOT ENABLE: blocks all tool calls]",
+  "description": "WARNING: DO NOT ENABLE THIS HOOK. Upstream Kiro IDE bug #7375/#7408/#7500: preToolUse hooks receive empty tool context (USER_PROMPT={}). With no context this hook fails closed and blocks EVERY tool call. If you enabled this hook and Kiro is now blocking all tools, disable it here immediately. The 'Pre Tool Use' event type is correct for pre-tool governance -- this hook is disabled until Kiro ships the fix. The Kiro CLI preToolUse surface works correctly and governs tool calls by default. Re-enable only after Kiro IDE delivers tool args to preToolUse hooks (or set CZ_KIRO_UNKNOWN_PAYLOAD=open in the hook environment to accept reduced governance). See docs/integrations/kiro.md.",
+  "version": "1",
+  "when": {
+    "type": "preToolUse",
+    "toolTypes": ["*"]
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "cz-kiro-adapter preToolUse",
+    "timeout": 5
+  }
+}

{controlzero-1.13.4 → controlzero-1.13.5}/controlzero/client.py

@@ -59,6 +59,7 @@ from controlzero.errors import (
     HybridModeError,
     PolicyLoadError,
     PolicyValidationError,
+    SecretValueLeakInPayload,
 )
 from controlzero.hitl import raise_on_leak
 from controlzero.policy_loader import load_policy, PolicySettings
@@ -709,7 +710,7 @@ class Client:
             "X-CZ-Requestor-Email": email,
         }
 
-        url = f"{get_api_url()}/api/approval-requests"
+        url = f"{get_api_url()}/v1/sdk/approval-requests"
 
         try:
             resp = httpx.post(url, json=body, headers=headers, timeout=10.0)
@@ -1051,7 +1052,7 @@ class Client:
                 "get_secret_poll_fn requires an API key"
             )
 
-        url = f"{get_api_url()}/api/approval-requests/{request_id}"
+        url = f"{get_api_url()}/v1/sdk/approval-requests/{request_id}"
         headers = {
             "Authorization": f"Bearer {self._api_key}",
             "Accept": "application/json",
@@ -1401,6 +1402,11 @@ class Client:
         except GrantProtocolError as exc:
             # denied / expired / revoked / timeout / backend-unreachable
             return self._synthetic_grant_deny(exc.reason_code, str(exc))
+        except SecretValueLeakInPayload:
+            # A secret-shaped value in the grant reason/payload is a caller/security
+            # error, NOT a backend outage. Surface E1709 clearly instead of a synthetic
+            # DENY mislabeled HITL_BACKEND_UNREACHABLE.
+            raise
         except Exception:  # noqa: BLE001
             # Defense-in-depth: any unanticipated error still fails
             # closed rather than leaking an allow.

{controlzero-1.13.4 → controlzero-1.13.5}/controlzero/hitl/secret_leak_guard.py

@@ -141,7 +141,11 @@ def is_likely_secret_value(value: str) -> bool:
         return True
 
     # Length + entropy floor.
-    if len(value) >= _ENTROPY_LEN_FLOOR:
+    # A real credential is a single contiguous token. Natural-language reason/message
+    # text contains whitespace and must NOT trip the value-leak scan (E1709 false
+    # positive on e.g. the default reason "function requires approval"). Genuine secrets
+    # embedded in an arg value are contiguous, so this keeps recall on real credentials.
+    if len(value) >= _ENTROPY_LEN_FLOOR and not any(ch.isspace() for ch in value):
         if _shannon_entropy(value) > _ENTROPY_BITS_PER_CHAR_FLOOR:
             return True
 

{controlzero-1.13.4 → controlzero-1.13.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "controlzero"
-version = "1.13.4"
+version = "1.13.5"
 description = "AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{controlzero-1.13.4 → controlzero-1.13.5}/tests/test_hitl_6a_request_approval.py

@@ -207,7 +207,7 @@ class TestHappyPath:
         assert kwargs["headers"]["X-CZ-Requestor-Email"] == "alice@example.com"
         assert kwargs["headers"]["Content-Type"] == "application/json"
         assert post.call_args[0][0] == (
-            "https://api.fake.test/api/approval-requests"
+            "https://api.fake.test/v1/sdk/approval-requests"
         )
 
         body = kwargs["json"]

{controlzero-1.13.4 → controlzero-1.13.5}/tests/test_hitl_6a_secret_leak_guard.py

@@ -65,6 +65,14 @@ class TestIsLikelySecretValue:
         assert len(value) == 32
         assert is_likely_secret_value(value) is True
 
+    def test_natural_language_reasons_return_false(self):
+        for value in (
+            "function requires approval",
+            "requested by SDK",
+            "please approve deploying the billing service to production",
+        ):
+            assert is_likely_secret_value(value) is False
+
     def test_sk_prefix_returns_true(self):
         # Short on purpose: prefix check must fire even when the
         # entropy floor wouldn't.

{controlzero-1.13.4 → controlzero-1.13.5}/tests/test_hitl_phase2b_protocol.py

@@ -33,6 +33,8 @@ import httpx
 import pytest
 import respx
 
+from controlzero.errors import SecretValueLeakInPayload
+
 import controlzero.audit_remote as audit_remote_module
 from controlzero import Client
 from controlzero.hitl import grant_protocol as gp
@@ -319,6 +321,23 @@ def _approval_decision(client, monkeypatch):
     monkeypatch.setattr(client, "guard", _fake_guard)
 
 
+def _approval_decision_with_reason(client, monkeypatch, reason):
+    from controlzero._internal.enforcer import PolicyDecision
+
+    def _fake_guard(tool, args=None, method="*", raise_on_deny=False, context=None):
+        d = PolicyDecision(
+            effect="deny",
+            policy_id="rule:hitl:1",
+            reason=reason,
+            reason_code="HITL_REQUIRES_APPROVAL",
+        )
+        d.requires_approval = True
+        d.approval_action = "delete_file"
+        return d
+
+    monkeypatch.setattr(client, "guard", _fake_guard)
+
+
 @pytest.mark.asyncio
 async def test_guard_with_approval_backward_compat_no_hitl(monkeypatch, tmp_path):
     # When guard() returns no requires_approval, the result is the
@@ -339,6 +358,41 @@ async def test_guard_with_approval_post_fails_denies(monkeypatch, tmp_path):
     assert decision.reason_code == "HITL_BACKEND_UNREACHABLE"
 
 
+@pytest.mark.asyncio
+async def test_guard_with_approval_default_reason_does_not_raise_e1709(monkeypatch, tmp_path):
+    client = _make_client(monkeypatch, tmp_path)
+    _approval_decision_with_reason(client, monkeypatch, "function requires approval")
+    with respx.mock(base_url=_API_URL) as mock:
+        mock.post("/api/grants").mock(
+            return_value=httpx.Response(200, json={"grant_id": "g1"})
+        )
+        mock.get("/api/grants/g1").mock(
+            return_value=httpx.Response(200, json={"state": "approved"})
+        )
+        decision = await client.guard_with_approval(
+            "delete_file", {"p": 1}, retry_guard=False
+        )
+    assert decision.effect == "allow"
+    assert decision.reason_code == "HITL_GRANT_APPROVED"
+
+
+@pytest.mark.asyncio
+async def test_guard_with_approval_secret_leak_raises_e1709(monkeypatch, tmp_path):
+    client = _make_client(monkeypatch, tmp_path)
+    _approval_decision_with_reason(
+        client,
+        monkeypatch,
+        "0123456789abcdef0123456789abcdef",
+    )
+    with respx.mock(base_url=_API_URL, assert_all_called=False) as mock:
+        post = mock.post("/api/grants").mock(
+            return_value=httpx.Response(200, json={"grant_id": "g1"})
+        )
+        with pytest.raises(SecretValueLeakInPayload):
+            await client.guard_with_approval("delete_file", {"p": 1})
+    assert post.call_count == 0
+
+
 @pytest.mark.asyncio
 async def test_guard_with_approval_denied(monkeypatch, tmp_path):
     client = _make_client(monkeypatch, tmp_path)

{controlzero-1.13.4 → controlzero-1.13.5}/tests/test_hosts_adapter.py

@@ -124,6 +124,49 @@ class TestCodexCLIClaim:
     def test_claims_via_codex_home_env(self):
         assert CodexCLIAdapter().claim({}, env={"CODEX_HOME": "/x"})
 
+    def test_claims_via_codex_cli_env(self):
+        assert CodexCLIAdapter().claim({}, env={"CODEX_CLI": "1"})
+
+    def test_does_NOT_claim_kiro_camel_pretooluse_even_with_codex_home(self):
+        # Bug #1655 regression: Kiro CLI exports CODEX_HOME (built on Codex)
+        # but sends camelCase preToolUse. CodexCLI must defer so KiroCLI claims
+        # and audit logs show "kiro_cli" not "codex_cli".
+        kiro_payload = {
+            "hook_event_name": "preToolUse",
+            "tool_name": "execute_bash",
+            "tool_input": {"command": "ls"},
+        }
+        assert not CodexCLIAdapter().claim(kiro_payload, env={"CODEX_HOME": "/home/x/.kiro/kiro-cli"})
+
+    def test_does_NOT_claim_kiro_camel_posttooluse_even_with_codex_home(self):
+        kiro_payload = {"hook_event_name": "postToolUse", "tool_name": "execute_bash"}
+        assert not CodexCLIAdapter().claim(kiro_payload, env={"CODEX_HOME": "/x"})
+
+    def test_does_NOT_claim_kiro_user_prompt_submit_even_with_codex_home(self):
+        kiro_payload = {"hook_event_name": "userPromptSubmit", "prompt": "hi"}
+        assert not CodexCLIAdapter().claim(kiro_payload, env={"CODEX_HOME": "/x"})
+
+    def test_kiro_camel_payload_picks_kiro_adapter_not_codex(self):
+        # Integration: select_adapter must pick KiroCLIAdapter for a camelCase
+        # Kiro payload even when CODEX_HOME is present in env.
+        kiro_payload = {
+            "hook_event_name": "preToolUse",
+            "tool_name": "execute_bash",
+            "tool_input": {"command": "rm -rf /"},
+        }
+        adapter = select_adapter(kiro_payload, env={"CODEX_HOME": "/home/x/.kiro"})
+        assert isinstance(adapter, KiroCLIAdapter)
+        assert adapter.canonical_source == "kiro_cli"
+
+    def test_codex_pascal_pretooluse_still_claims_with_codex_home(self):
+        # PascalCase PreToolUse is Codex's own event shape -- must still claim.
+        codex_payload = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "ls"},
+        }
+        assert CodexCLIAdapter().claim(codex_payload, env={"CODEX_HOME": "/x"})
+
 
 class TestUnknownClaim:
     def test_always_claims(self):

controlzero-1.13.4/controlzero/cli/templates/kiro/ide-pre-tool-use.kiro.hook

@@ -1,15 +0,0 @@
-{
-  "enabled": false,
-  "name": "Control Zero - Pre Tool Use (disabled: upstream Kiro IDE bug)",
-  "description": "Control Zero governance: evaluate every Kiro tool call against your policy BEFORE it runs. SHIPPED DISABLED on the IDE surface because upstream Kiro (#7375/#7408/#7500, IDE v0.11) delivers an empty USER_PROMPT={} to IDE preToolUse runCommand hooks -- with no tool context the adapter cannot make an informed allow decision and, fail-closed (CZ_KIRO_UNKNOWN_PAYLOAD=closed), would block EVERY tool call. Enable this hook ONLY after upstream ships the tool-context fix (or set CZ_KIRO_UNKNOWN_PAYLOAD=open to accept the loss of pre-tool policy). The Kiro CLI preToolUse surface is full-fidelity and is wired by default. See docs/integrations/kiro.md.",
-  "version": "1",
-  "when": {
-    "type": "preToolUse",
-    "toolTypes": ["*"]
-  },
-  "then": {
-    "type": "runCommand",
-    "command": "cz-kiro-adapter preToolUse",
-    "timeout": 5
-  }
-}