controlzero 1.13.4__tar.gz → 1.13.6__tar.gz

{controlzero-1.13.4 → controlzero-1.13.6}/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 1.13.6 (2026-07-12): interpreter-pinned hook command (P0)
+
+### Fixed
+
+- **Claude Code / Gemini CLI / Codex CLI hook command is now interpreter-pinned,
+  not PATH-dependent (#1705, P0).** `controlzero install` wired the PreToolUse
+  hook as a bare `controlzero hook-check`; if a stale/older `controlzero`
+  binary (pre-`hook-check`) sat earlier on PATH than the interpreter that ran
+  install, the hook resolved to the wrong binary, errored with `invalid
+  choice: 'hook-check'`, and Claude Code HARD-BLOCKED every tool call. The
+  installer now writes `"<sys.executable>" -m controlzero hook-check` (the
+  same PATH-immune form #1265 shipped for Cursor / kiro-cli). The legacy bare
+  form is still recognised by hook-integrity / `verify` for back-compat, and
+  `verify` now WARNs (does not fail) when it finds a pre-#1705 bare command
+  still installed, recommending a re-`install` to migrate.
+
+## 1.13.5 (2026-07-06): HITL key-authed approval path + kiro-cli hook misattribution fix
+
+### Fixed
+
+- **SDK-driven HITL now works for key-authed agents (#1601, P0).**
+  `request_approval` POST `/api/approval-requests` and poll GET
+  `/api/approval-requests/{id}` sat under the browser/session `userAuth`
+  chain, so a `cz_live` API key got a 401 and HITL was non-functional for
+  real agents. Added a key-authed POST/GET `/v1/sdk/approval-requests`
+  surface (mirrors the already-working `/api/grants` precedent); org and
+  project resolve from the key, and the project is pinned to the key on
+  both create AND poll (an agent cannot target or read another project's
+  approval requests). The Python SDK now points at the key-authed path.
+- **E1709 leak-guard false-positive on ordinary English (#1601, P1).** The
+  entropy heuristic (`len>=24` + `entropy>3.5`) flagged plain text like the
+  default reason `"function requires approval"`, and
+  `enforce`/`guard_with_approval` swallowed the resulting
+  `SecretValueLeakInPayload` into a misleading `HITL_BACKEND_UNREACHABLE`
+  deny. The entropy heuristic is now gated on no-whitespace (a real
+  credential is a contiguous token), and the leak error propagates
+  distinctly instead of degrading to a backend-unreachable deny.
+- **Kiro CLI hooks misattributed to Codex CLI, mis-scoring the audit source
+  (#1655).** Kiro CLI is built on Codex and exports `CODEX_HOME`/
+  `CODEX_CLI`, so `CodexCLIAdapter.claim()` was winning on those env hints
+  before `KiroCLIAdapter` could check. `CodexCLIAdapter` now defers when
+  `hook_event_name` is a Kiro camelCase event (`preToolUse`, `postToolUse`,
+  `userPromptSubmit`, `agentSpawn`, `stop`) -- byte-disjoint from Codex's
+  PascalCase `PreToolUse`.
+- **Kiro IDE pre-tool-use hook UX.** The opaque "empty/unparseable IDE
+  payload; blocking" message now names the upstream bug (#7375/#7408/#7500),
+  explains the cause, and directs the user to disable the hook in Kiro IDE
+  Settings > Hooks. The shipped `ide-pre-tool-use.kiro.hook` template
+  name/description now leads with "[DO NOT ENABLE: blocks all tool calls]"
+  instead of burying the warning.
+
 ## 1.13.4 (2026-07-05): deny-wins fail-open fix (P0)
 
 ### Fixed

{controlzero-1.13.4 → controlzero-1.13.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.4
+Version: 1.13.6
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.4"
+__version__ = "1.13.6"
 
 __all__ = [
     "Client",

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/cli/enforcement.py

@@ -859,3 +859,34 @@ def installed_command(adapter: str, home: Optional[Path] = None, cwd: Optional[P
             return _first_cz_command(_load_json(settings), ("preToolUse",))
         return None
     return None
+
+
+# ---------------------------------------------------------------------------
+# Bare, PATH-shadowable hook command detection (#1705).
+# ---------------------------------------------------------------------------
+
+# Adapters whose installer now emits the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` form (#1705). A bare
+# `controlzero hook-check` found installed for one of these is either a
+# pre-#1705 install or a hand-edited config -- both are PATH-shadowable (a
+# stale/older `controlzero` earlier on PATH silently resolves instead of the
+# interpreter that ran install) and should be flagged so the operator
+# re-runs `controlzero install` to migrate. Cursor / Kiro CLI / Kiro v3
+# already pinned before #1705 (#1265); Antigravity intentionally still emits
+# the bare form and is not covered by this check.
+BARE_HOOK_COMMAND_ADAPTERS = ("claude_code", "gemini_cli", "codex_cli")
+
+# The literal bare command these adapters wrote before #1705.
+LEGACY_BARE_HOOK_CHECK_COMMAND = "controlzero hook-check"
+
+
+def is_bare_shadowable_hook_command(command: Optional[str]) -> bool:
+    """True if ``command`` is exactly the historical bare ``controlzero
+    hook-check`` form (#1705): PATH-dependent, so a stale/older
+    ``controlzero`` binary earlier on PATH can silently resolve instead of
+    the interpreter that ran install. The current installer emits the
+    interpreter-pinned ``"<sys.executable>" -m controlzero hook-check`` form
+    instead; this only flags configs that predate that fix (or were
+    hand-edited back to bare). ``None`` (no command installed) is not bare.
+    """
+    return command == LEGACY_BARE_HOOK_CHECK_COMMAND

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/cli/hosts/codex_cli.py

@@ -35,6 +35,15 @@ from controlzero.cli.hosts.base import CoverageDecl, CZDecision, HostAdapter
 # fail-open backstop).
 _CODEX_CLI_CLIENTS = ("codex-cli", "codex_cli", "codex")
 
+# Kiro CLI v3 is built on the Codex codebase and exports CODEX_HOME/CODEX_CLI.
+# Its hooks send camelCase hook_event_name values (preToolUse, postToolUse,
+# userPromptSubmit) -- byte-disjoint from Codex's PascalCase (PreToolUse).
+# When we see a camelCase event, defer to KiroCLIAdapter rather than claiming
+# the call based on CODEX_HOME/CODEX_CLI env hints alone (Bug #1655).
+_KIRO_CLI_CAMEL_EVENTS = frozenset(
+    {"preToolUse", "postToolUse", "userPromptSubmit", "agentSpawn", "stop"}
+)
+
 
 class CodexCLIAdapter(HostAdapter):
     name = "codex_cli"
@@ -66,6 +75,12 @@ class CodexCLIAdapter(HostAdapter):
         # pinned host's adapter (not this one) claims the call.
         if self._pinned_elsewhere(env, _CODEX_CLI_CLIENTS):
             return False
+        # Kiro CLI exports CODEX_HOME/CODEX_CLI (built on Codex codebase) but
+        # sends camelCase hook_event_name values (preToolUse vs Codex's
+        # PascalCase PreToolUse). Defer to KiroCLIAdapter when we see a
+        # camelCase Kiro event so audit logs show "kiro_cli" not "codex_cli".
+        if isinstance(payload, dict) and payload.get("hook_event_name") in _KIRO_CLI_CAMEL_EVENTS:
+            return False
         for hint in self._ENV_HINTS:
             if env.get(hint):
                 return True

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/cli/kiro_adapter.py

@@ -134,9 +134,17 @@ def main(argv: list[str] | None = None) -> int:
                 file=sys.stderr,
             )
             return 0
+        # Upstream Kiro IDE bug #7375/#7408/#7500: preToolUse hooks receive
+        # USER_PROMPT={} with no tool context. The 'Control Zero - Pre Tool Use'
+        # hook in Kiro IDE settings ships DISABLED to prevent this. If you are
+        # seeing this message, you have enabled that hook. Disable it in Kiro
+        # IDE Settings > Hooks to restore normal tool execution.
         print(
-            "controlzero(kiro): empty/unparseable IDE payload; blocking "
-            "(fail-closed; set CZ_KIRO_UNKNOWN_PAYLOAD=open to override)",
+            f"controlzero(kiro): {event} hook received empty payload "
+            "(upstream Kiro IDE bug #7375/#7408/#7500 -- preToolUse delivers "
+            "USER_PROMPT={}). Failing closed. FIX: disable the "
+            "'Control Zero - Pre Tool Use' hook in Kiro IDE Settings > Hooks. "
+            "Set CZ_KIRO_UNKNOWN_PAYLOAD=open in the hook env to allow instead.",
             file=sys.stderr,
         )
         return 2

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/cli/main.py

@@ -1320,6 +1320,7 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
     if prove:
         sys.exit(_run_prove_enforcement(as_json))
 
+    from controlzero.cli import enforcement
     from controlzero.hook_integrity import (
         baseline_exists,
         check_hook_integrity,
@@ -1332,6 +1333,15 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
     has_baseline = baseline_exists(GLOBAL_POLICY_DIR)
     tamper = bool(hook_findings or env_findings)
 
+    # #1705: a bare, PATH-shadowable `controlzero hook-check` predates the
+    # interpreter-pinned fix (or was hand-edited back to bare). Not tamper --
+    # it is a recognised, working CZ hook -- so it does not affect `tamper` /
+    # the exit code, only surfaces as a WARN recommending re-install.
+    bare_adapters = [
+        a for a in enforcement.BARE_HOOK_COMMAND_ADAPTERS
+        if enforcement.is_bare_shadowable_hook_command(enforcement.installed_command(a))
+    ]
+
     if tamper and report:
         _report_hook_tamper(hook_findings, env_findings)
 
@@ -1342,6 +1352,7 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
             "baseline_tampered": integrity.baseline_tampered,
             "hook_findings": hook_findings,
             "env_findings": env_findings,
+            "bare_hook_command_adapters": bare_adapters,
         }, indent=2))
     else:
         click.echo("Control Zero tamper-resistance verify")
@@ -1364,6 +1375,14 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
                 click.echo(f"    - [env] {f['name']}: {f['reason']}")
         else:
             click.secho("  status           : OK (hooks intact)", fg="green")
+        for a in bare_adapters:
+            click.secho(
+                f"  ~ WARNING: {a} hook command is the bare, PATH-shadowable "
+                "'controlzero hook-check' form -- re-run `controlzero install "
+                f"{a.replace('_', '-')}` to migrate to the interpreter-pinned "
+                "form (#1705).",
+                fg="yellow",
+            )
 
     if not has_baseline:
         sys.exit(4)
@@ -1427,6 +1446,29 @@ _ANTIGRAVITY_PRETOOL_MATCHER = "*"     # agy special-cases "*" (NOT RE2-compiled
 _KIRO_POSTTOOL_MATCHER = "*"           # observe-only postToolUse match-all
 
 
+def _pinned_hook_check_command() -> str:
+    """Interpreter-pinned `controlzero hook-check` command for Claude Code /
+    Gemini CLI / Codex CLI (#1705).
+
+    A bare ``controlzero hook-check`` is PATH-dependent: the agent's hook
+    subshell resolves ``controlzero`` against ITS PATH at hook-execution time,
+    not against the interpreter that ran ``install``. If a stale/older
+    ``controlzero`` binary (one whose only subcommands are
+    ``setup``/``status``/``uninstall``, i.e. pre-``hook-check``) sits earlier
+    on PATH than the one installed into this interpreter's venv, the hook
+    resolves to the wrong binary, prints ``invalid choice: 'hook-check'``,
+    exits non-zero, and the agent HARD-BLOCKS every tool call -- bricking the
+    session. This actually happened (#1705).
+
+    Pinning ``sys.executable -m controlzero`` -- the same fix #1265 shipped
+    for Cursor / kiro-cli -- makes the agent invoke the EXACT interpreter that
+    ran install, which provably has ``hook-check``, regardless of PATH or venv
+    activation. Double-quoted so a space in the interpreter path survives
+    /bin/sh and cmd.exe.
+    """
+    return f'"{sys.executable}" -m controlzero hook-check'
+
+
 @cli.command("hook-check")
 @click.option(
     "--policy",
@@ -3736,7 +3778,10 @@ def install_claude_code(force: bool, merge: bool, settings: Optional[str], api_k
     # env-prefix was a Windows-portability bug (PowerShell / cmd.exe cannot
     # parse the syntax) AND placed the cleartext key into settings.json on
     # disk. Both go away here. See 2026-05-12 incident.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` -- see
+    # _pinned_hook_check_command() (#1705: a stale controlzero earlier on
+    # PATH otherwise hard-blocks every tool call).
+    hook_command = _pinned_hook_check_command()
     new_block = {
         "matcher": _CLAUDE_CODE_PRETOOL_MATCHER,
         "hooks": [
@@ -3913,7 +3958,9 @@ def install_gemini_cli(force: bool, merge: bool, settings: Optional[str], api_ke
     # _write_api_key_config above). The legacy bash-only env-prefix
     # broke Windows; see the claude-code install path for the full
     # rationale.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` (#1705); see
+    # _pinned_hook_check_command().
+    hook_command = _pinned_hook_check_command()
 
     # Gemini CLI expects a nested structure:
     #   { matcher: "regex", hooks: [{ type: "command", command: "...", timeout: N }] }
@@ -4113,7 +4160,9 @@ def install_codex_cli(force: bool, merge: bool, config: Optional[str], api_key:
     # _write_api_key_config above). The legacy bash-only env-prefix
     # broke Windows; see the claude-code install path for the full
     # rationale.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` (#1705); see
+    # _pinned_hook_check_command().
+    hook_command = _pinned_hook_check_command()
 
     new_hook_entry = {
         "matcher": _CODEX_PRETOOL_MATCHER,

controlzero-1.13.6/controlzero/cli/templates/kiro/ide-pre-tool-use.kiro.hook

@@ -0,0 +1,15 @@
+{
+  "enabled": false,
+  "name": "Control Zero - Pre Tool Use [DO NOT ENABLE: blocks all tool calls]",
+  "description": "WARNING: DO NOT ENABLE THIS HOOK. Upstream Kiro IDE bug #7375/#7408/#7500: preToolUse hooks receive empty tool context (USER_PROMPT={}). With no context this hook fails closed and blocks EVERY tool call. If you enabled this hook and Kiro is now blocking all tools, disable it here immediately. The 'Pre Tool Use' event type is correct for pre-tool governance -- this hook is disabled until Kiro ships the fix. The Kiro CLI preToolUse surface works correctly and governs tool calls by default. Re-enable only after Kiro IDE delivers tool args to preToolUse hooks (or set CZ_KIRO_UNKNOWN_PAYLOAD=open in the hook environment to accept reduced governance). See docs/integrations/kiro.md.",
+  "version": "1",
+  "when": {
+    "type": "preToolUse",
+    "toolTypes": ["*"]
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "cz-kiro-adapter preToolUse",
+    "timeout": 5
+  }
+}

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/client.py

@@ -59,6 +59,7 @@ from controlzero.errors import (
     HybridModeError,
     PolicyLoadError,
     PolicyValidationError,
+    SecretValueLeakInPayload,
 )
 from controlzero.hitl import raise_on_leak
 from controlzero.policy_loader import load_policy, PolicySettings
@@ -709,7 +710,7 @@ class Client:
             "X-CZ-Requestor-Email": email,
         }
 
-        url = f"{get_api_url()}/api/approval-requests"
+        url = f"{get_api_url()}/v1/sdk/approval-requests"
 
         try:
             resp = httpx.post(url, json=body, headers=headers, timeout=10.0)
@@ -1051,7 +1052,7 @@ class Client:
                 "get_secret_poll_fn requires an API key"
             )
 
-        url = f"{get_api_url()}/api/approval-requests/{request_id}"
+        url = f"{get_api_url()}/v1/sdk/approval-requests/{request_id}"
         headers = {
             "Authorization": f"Bearer {self._api_key}",
             "Accept": "application/json",
@@ -1401,6 +1402,11 @@ class Client:
         except GrantProtocolError as exc:
             # denied / expired / revoked / timeout / backend-unreachable
             return self._synthetic_grant_deny(exc.reason_code, str(exc))
+        except SecretValueLeakInPayload:
+            # A secret-shaped value in the grant reason/payload is a caller/security
+            # error, NOT a backend outage. Surface E1709 clearly instead of a synthetic
+            # DENY mislabeled HITL_BACKEND_UNREACHABLE.
+            raise
         except Exception:  # noqa: BLE001
             # Defense-in-depth: any unanticipated error still fails
             # closed rather than leaking an allow.

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/hitl/secret_leak_guard.py

@@ -141,7 +141,11 @@ def is_likely_secret_value(value: str) -> bool:
         return True
 
     # Length + entropy floor.
-    if len(value) >= _ENTROPY_LEN_FLOOR:
+    # A real credential is a single contiguous token. Natural-language reason/message
+    # text contains whitespace and must NOT trip the value-leak scan (E1709 false
+    # positive on e.g. the default reason "function requires approval"). Genuine secrets
+    # embedded in an arg value are contiguous, so this keeps recall on real credentials.
+    if len(value) >= _ENTROPY_LEN_FLOOR and not any(ch.isspace() for ch in value):
         if _shannon_entropy(value) > _ENTROPY_BITS_PER_CHAR_FLOOR:
             return True
 

{controlzero-1.13.4 → controlzero-1.13.6}/controlzero/hook_integrity.py

@@ -63,12 +63,18 @@ from typing import Iterable, Optional
 from controlzero.tamper import load_or_create_secret, sign_bundle, verify_bundle
 
 # The CZ hook command is recognised by this substring on every host. Both
-# the bare ``controlzero hook-check`` form (Claude / Gemini / Codex /
-# Antigravity) and the interpreter-pinned ``"<py>" -m controlzero
-# hook-check --strict`` form (Cursor / Kiro CLI / Kiro v3) contain it, as
-# does the Kiro IDE adapter command (``-m controlzero.cli.kiro_adapter``).
+# the bare ``controlzero hook-check`` form and the interpreter-pinned
+# ``"<py>" -m controlzero hook-check [--strict]`` form contain it, as does
+# the Kiro IDE adapter command (``-m controlzero.cli.kiro_adapter``).
 # Keeping the marker broad means a renamed-but-still-CZ command still
 # matches, so an attacker cannot evade the baseline by reformatting.
+#
+# As of #1705, Claude Code / Gemini CLI / Codex CLI installs also emit the
+# interpreter-pinned form (previously only Cursor / Kiro CLI / Kiro v3 did;
+# Antigravity still emits bare). The bare form is kept recognised here on
+# purpose: an install from BEFORE #1705 (or a hand-edited config) still
+# carries it, and this marker is what lets `verify` / `uninstall` / a
+# re-`install` find and migrate it rather than treating it as untracked.
 HOOK_COMMAND_MARKERS = ("controlzero hook-check", "controlzero.cli.kiro_adapter")
 
 BASELINE_FILE_NAME = "hook_baseline.json"

{controlzero-1.13.4 → controlzero-1.13.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "controlzero"
-version = "1.13.4"
+version = "1.13.6"
 description = "AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{controlzero-1.13.4 → controlzero-1.13.6}/tests/test_cli_hook.py

@@ -1,12 +1,18 @@
 """Tests for `controlzero hook-check` and `controlzero install claude-code`."""
 
 import json
+import sys
 from pathlib import Path
 
 from click.testing import CliRunner
 
 from controlzero.cli.main import cli
 
+# #1705: the installer wires the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` command, not a bare
+# `controlzero hook-check` (PATH-shadowable).
+PINNED_HOOK_COMMAND = f'"{sys.executable}" -m controlzero hook-check'
+
 
 def write_policy(tmp_path: Path, rules: list) -> Path:
     p = tmp_path / "policy.yaml"
@@ -189,7 +195,7 @@ def test_install_claude_code_creates_files(tmp_path, monkeypatch):
     settings = json.loads(settings_path.read_text())
     pre_tool = settings["hooks"]["PreToolUse"]
     assert any(
-        h.get("command") == "controlzero hook-check"
+        h.get("command") == PINNED_HOOK_COMMAND
         for block in pre_tool
         for h in block.get("hooks", [])
     )
@@ -216,7 +222,7 @@ def test_install_claude_code_idempotent(tmp_path, monkeypatch):
         h
         for block in pre_tool
         for h in block.get("hooks", [])
-        if h.get("command") == "controlzero hook-check"
+        if h.get("command") == PINNED_HOOK_COMMAND
     ]
     assert len(cz_hooks) == 1, f"expected 1 cz hook, got {len(cz_hooks)}"
 
@@ -267,7 +273,7 @@ def test_install_claude_code_preserves_other_hooks(tmp_path, monkeypatch):
         for h in block.get("hooks", [])
     ]
     assert "some-other-tool" in commands
-    assert "controlzero hook-check" in commands
+    assert PINNED_HOOK_COMMAND in commands
 
 
 def test_install_claude_code_skips_existing_policy(tmp_path, monkeypatch):

{controlzero-1.13.4 → controlzero-1.13.6}/tests/test_coding_agent_hooks.py

@@ -39,6 +39,7 @@ from __future__ import annotations
 import importlib
 import json
 import os
+import sys
 from pathlib import Path
 
 import yaml
@@ -48,6 +49,12 @@ from controlzero._internal.enforcer import PolicyEvaluator
 from controlzero.cli.main import cli
 from controlzero.policy_loader import load_policy
 
+# #1705: the installer now wires the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` command, not a bare
+# `controlzero hook-check` (PATH-shadowable -- see main.py's
+# _pinned_hook_check_command()).
+PINNED_HOOK_COMMAND = f'"{sys.executable}" -m controlzero hook-check'
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -710,12 +717,13 @@ class TestApiKeyOption:
         pre_tool = settings["hooks"]["PreToolUse"]
         assert len(pre_tool) == 1
         hook_cmd = pre_tool[0]["hooks"][0]["command"]
-        # 1.5.2 portability fix: the hook command is plain
-        # `controlzero hook-check`. The api key flows through
+        # 1.5.2 portability fix: the api key flows through
         # ~/.controlzero/config.yaml (see _write_api_key_config) so it
         # is no longer embedded in settings.json (Windows shells could
-        # not parse the bash-only env-prefix syntax).
-        assert hook_cmd == "controlzero hook-check"
+        # not parse the bash-only env-prefix syntax). #1705: the command
+        # is the interpreter-pinned form, not a bare `controlzero
+        # hook-check` (PATH-shadowable).
+        assert hook_cmd == PINNED_HOOK_COMMAND
         assert "cz_live_" not in hook_cmd
         assert "CONTROLZERO_API_KEY=" not in hook_cmd
 
@@ -739,8 +747,8 @@ class TestApiKeyOption:
         # Nested format: check inside the hooks array
         inner_hooks = before_tool[0].get("hooks", [])
         assert len(inner_hooks) == 1
-        # 1.5.2: hook command is plain, key flows via config.yaml.
-        assert inner_hooks[0]["command"] == "controlzero hook-check"
+        # 1.5.2: key flows via config.yaml. #1705: interpreter-pinned command.
+        assert inner_hooks[0]["command"] == PINNED_HOOK_COMMAND
         assert "cz_test_" not in inner_hooks[0]["command"]
 
     def test_install_codex_cli_with_api_key_updates_hooks_json(
@@ -763,8 +771,8 @@ class TestApiKeyOption:
         assert len(pre_tool) == 1
         inner_hooks = pre_tool[0].get("hooks", [])
         assert len(inner_hooks) == 1
-        # 1.5.2: hook command is plain, key flows via config.yaml.
-        assert inner_hooks[0]["command"] == "controlzero hook-check"
+        # 1.5.2: key flows via config.yaml. #1705: interpreter-pinned command.
+        assert inner_hooks[0]["command"] == PINNED_HOOK_COMMAND
         assert "cz_live_" not in inner_hooks[0]["command"]
 
     def test_install_with_invalid_api_key_exits_with_error(

{controlzero-1.13.4 → controlzero-1.13.6}/tests/test_hitl_6a_request_approval.py

@@ -207,7 +207,7 @@ class TestHappyPath:
         assert kwargs["headers"]["X-CZ-Requestor-Email"] == "alice@example.com"
         assert kwargs["headers"]["Content-Type"] == "application/json"
         assert post.call_args[0][0] == (
-            "https://api.fake.test/api/approval-requests"
+            "https://api.fake.test/v1/sdk/approval-requests"
         )
 
         body = kwargs["json"]

{controlzero-1.13.4 → controlzero-1.13.6}/tests/test_hitl_6a_secret_leak_guard.py

@@ -65,6 +65,14 @@ class TestIsLikelySecretValue:
         assert len(value) == 32
         assert is_likely_secret_value(value) is True
 
+    def test_natural_language_reasons_return_false(self):
+        for value in (
+            "function requires approval",
+            "requested by SDK",
+            "please approve deploying the billing service to production",
+        ):
+            assert is_likely_secret_value(value) is False
+
     def test_sk_prefix_returns_true(self):
         # Short on purpose: prefix check must fire even when the
         # entropy floor wouldn't.

{controlzero-1.13.4 → controlzero-1.13.6}/tests/test_hitl_phase2b_protocol.py

@@ -33,6 +33,8 @@ import httpx
 import pytest
 import respx
 
+from controlzero.errors import SecretValueLeakInPayload
+
 import controlzero.audit_remote as audit_remote_module
 from controlzero import Client
 from controlzero.hitl import grant_protocol as gp
@@ -319,6 +321,23 @@ def _approval_decision(client, monkeypatch):
     monkeypatch.setattr(client, "guard", _fake_guard)
 
 
+def _approval_decision_with_reason(client, monkeypatch, reason):
+    from controlzero._internal.enforcer import PolicyDecision
+
+    def _fake_guard(tool, args=None, method="*", raise_on_deny=False, context=None):
+        d = PolicyDecision(
+            effect="deny",
+            policy_id="rule:hitl:1",
+            reason=reason,
+            reason_code="HITL_REQUIRES_APPROVAL",
+        )
+        d.requires_approval = True
+        d.approval_action = "delete_file"
+        return d
+
+    monkeypatch.setattr(client, "guard", _fake_guard)
+
+
 @pytest.mark.asyncio
 async def test_guard_with_approval_backward_compat_no_hitl(monkeypatch, tmp_path):
     # When guard() returns no requires_approval, the result is the
@@ -339,6 +358,41 @@ async def test_guard_with_approval_post_fails_denies(monkeypatch, tmp_path):
     assert decision.reason_code == "HITL_BACKEND_UNREACHABLE"
 
 
+@pytest.mark.asyncio
+async def test_guard_with_approval_default_reason_does_not_raise_e1709(monkeypatch, tmp_path):
+    client = _make_client(monkeypatch, tmp_path)
+    _approval_decision_with_reason(client, monkeypatch, "function requires approval")
+    with respx.mock(base_url=_API_URL) as mock:
+        mock.post("/api/grants").mock(
+            return_value=httpx.Response(200, json={"grant_id": "g1"})
+        )
+        mock.get("/api/grants/g1").mock(
+            return_value=httpx.Response(200, json={"state": "approved"})
+        )
+        decision = await client.guard_with_approval(
+            "delete_file", {"p": 1}, retry_guard=False
+        )
+    assert decision.effect == "allow"
+    assert decision.reason_code == "HITL_GRANT_APPROVED"
+
+
+@pytest.mark.asyncio
+async def test_guard_with_approval_secret_leak_raises_e1709(monkeypatch, tmp_path):
+    client = _make_client(monkeypatch, tmp_path)
+    _approval_decision_with_reason(
+        client,
+        monkeypatch,
+        "0123456789abcdef0123456789abcdef",
+    )
+    with respx.mock(base_url=_API_URL, assert_all_called=False) as mock:
+        post = mock.post("/api/grants").mock(
+            return_value=httpx.Response(200, json={"grant_id": "g1"})
+        )
+        with pytest.raises(SecretValueLeakInPayload):
+            await client.guard_with_approval("delete_file", {"p": 1})
+    assert post.call_count == 0
+
+
 @pytest.mark.asyncio
 async def test_guard_with_approval_denied(monkeypatch, tmp_path):
     client = _make_client(monkeypatch, tmp_path)