controlzero 1.13.5__tar.gz → 1.13.6__tar.gz

{controlzero-1.13.5 → controlzero-1.13.6}/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 1.13.6 (2026-07-12): interpreter-pinned hook command (P0)
+
+### Fixed
+
+- **Claude Code / Gemini CLI / Codex CLI hook command is now interpreter-pinned,
+  not PATH-dependent (#1705, P0).** `controlzero install` wired the PreToolUse
+  hook as a bare `controlzero hook-check`; if a stale/older `controlzero`
+  binary (pre-`hook-check`) sat earlier on PATH than the interpreter that ran
+  install, the hook resolved to the wrong binary, errored with `invalid
+  choice: 'hook-check'`, and Claude Code HARD-BLOCKED every tool call. The
+  installer now writes `"<sys.executable>" -m controlzero hook-check` (the
+  same PATH-immune form #1265 shipped for Cursor / kiro-cli). The legacy bare
+  form is still recognised by hook-integrity / `verify` for back-compat, and
+  `verify` now WARNs (does not fail) when it finds a pre-#1705 bare command
+  still installed, recommending a re-`install` to migrate.
+
+## 1.13.5 (2026-07-06): HITL key-authed approval path + kiro-cli hook misattribution fix
+
+### Fixed
+
+- **SDK-driven HITL now works for key-authed agents (#1601, P0).**
+  `request_approval` POST `/api/approval-requests` and poll GET
+  `/api/approval-requests/{id}` sat under the browser/session `userAuth`
+  chain, so a `cz_live` API key got a 401 and HITL was non-functional for
+  real agents. Added a key-authed POST/GET `/v1/sdk/approval-requests`
+  surface (mirrors the already-working `/api/grants` precedent); org and
+  project resolve from the key, and the project is pinned to the key on
+  both create AND poll (an agent cannot target or read another project's
+  approval requests). The Python SDK now points at the key-authed path.
+- **E1709 leak-guard false-positive on ordinary English (#1601, P1).** The
+  entropy heuristic (`len>=24` + `entropy>3.5`) flagged plain text like the
+  default reason `"function requires approval"`, and
+  `enforce`/`guard_with_approval` swallowed the resulting
+  `SecretValueLeakInPayload` into a misleading `HITL_BACKEND_UNREACHABLE`
+  deny. The entropy heuristic is now gated on no-whitespace (a real
+  credential is a contiguous token), and the leak error propagates
+  distinctly instead of degrading to a backend-unreachable deny.
+- **Kiro CLI hooks misattributed to Codex CLI, mis-scoring the audit source
+  (#1655).** Kiro CLI is built on Codex and exports `CODEX_HOME`/
+  `CODEX_CLI`, so `CodexCLIAdapter.claim()` was winning on those env hints
+  before `KiroCLIAdapter` could check. `CodexCLIAdapter` now defers when
+  `hook_event_name` is a Kiro camelCase event (`preToolUse`, `postToolUse`,
+  `userPromptSubmit`, `agentSpawn`, `stop`) -- byte-disjoint from Codex's
+  PascalCase `PreToolUse`.
+- **Kiro IDE pre-tool-use hook UX.** The opaque "empty/unparseable IDE
+  payload; blocking" message now names the upstream bug (#7375/#7408/#7500),
+  explains the cause, and directs the user to disable the hook in Kiro IDE
+  Settings > Hooks. The shipped `ide-pre-tool-use.kiro.hook` template
+  name/description now leads with "[DO NOT ENABLE: blocks all tool calls]"
+  instead of burying the warning.
+
 ## 1.13.4 (2026-07-05): deny-wins fail-open fix (P0)
 
 ### Fixed

{controlzero-1.13.5 → controlzero-1.13.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.5
+Version: 1.13.6
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.5 → controlzero-1.13.6}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.5"
+__version__ = "1.13.6"
 
 __all__ = [
     "Client",

{controlzero-1.13.5 → controlzero-1.13.6}/controlzero/cli/enforcement.py

@@ -859,3 +859,34 @@ def installed_command(adapter: str, home: Optional[Path] = None, cwd: Optional[P
             return _first_cz_command(_load_json(settings), ("preToolUse",))
         return None
     return None
+
+
+# ---------------------------------------------------------------------------
+# Bare, PATH-shadowable hook command detection (#1705).
+# ---------------------------------------------------------------------------
+
+# Adapters whose installer now emits the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` form (#1705). A bare
+# `controlzero hook-check` found installed for one of these is either a
+# pre-#1705 install or a hand-edited config -- both are PATH-shadowable (a
+# stale/older `controlzero` earlier on PATH silently resolves instead of the
+# interpreter that ran install) and should be flagged so the operator
+# re-runs `controlzero install` to migrate. Cursor / Kiro CLI / Kiro v3
+# already pinned before #1705 (#1265); Antigravity intentionally still emits
+# the bare form and is not covered by this check.
+BARE_HOOK_COMMAND_ADAPTERS = ("claude_code", "gemini_cli", "codex_cli")
+
+# The literal bare command these adapters wrote before #1705.
+LEGACY_BARE_HOOK_CHECK_COMMAND = "controlzero hook-check"
+
+
+def is_bare_shadowable_hook_command(command: Optional[str]) -> bool:
+    """True if ``command`` is exactly the historical bare ``controlzero
+    hook-check`` form (#1705): PATH-dependent, so a stale/older
+    ``controlzero`` binary earlier on PATH can silently resolve instead of
+    the interpreter that ran install. The current installer emits the
+    interpreter-pinned ``"<sys.executable>" -m controlzero hook-check`` form
+    instead; this only flags configs that predate that fix (or were
+    hand-edited back to bare). ``None`` (no command installed) is not bare.
+    """
+    return command == LEGACY_BARE_HOOK_CHECK_COMMAND

{controlzero-1.13.5 → controlzero-1.13.6}/controlzero/cli/main.py

@@ -1320,6 +1320,7 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
     if prove:
         sys.exit(_run_prove_enforcement(as_json))
 
+    from controlzero.cli import enforcement
     from controlzero.hook_integrity import (
         baseline_exists,
         check_hook_integrity,
@@ -1332,6 +1333,15 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
     has_baseline = baseline_exists(GLOBAL_POLICY_DIR)
     tamper = bool(hook_findings or env_findings)
 
+    # #1705: a bare, PATH-shadowable `controlzero hook-check` predates the
+    # interpreter-pinned fix (or was hand-edited back to bare). Not tamper --
+    # it is a recognised, working CZ hook -- so it does not affect `tamper` /
+    # the exit code, only surfaces as a WARN recommending re-install.
+    bare_adapters = [
+        a for a in enforcement.BARE_HOOK_COMMAND_ADAPTERS
+        if enforcement.is_bare_shadowable_hook_command(enforcement.installed_command(a))
+    ]
+
     if tamper and report:
         _report_hook_tamper(hook_findings, env_findings)
 
@@ -1342,6 +1352,7 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
             "baseline_tampered": integrity.baseline_tampered,
             "hook_findings": hook_findings,
             "env_findings": env_findings,
+            "bare_hook_command_adapters": bare_adapters,
         }, indent=2))
     else:
         click.echo("Control Zero tamper-resistance verify")
@@ -1364,6 +1375,14 @@ def verify_cmd(as_json: bool, report: bool, prove: bool):
                 click.echo(f"    - [env] {f['name']}: {f['reason']}")
         else:
             click.secho("  status           : OK (hooks intact)", fg="green")
+        for a in bare_adapters:
+            click.secho(
+                f"  ~ WARNING: {a} hook command is the bare, PATH-shadowable "
+                "'controlzero hook-check' form -- re-run `controlzero install "
+                f"{a.replace('_', '-')}` to migrate to the interpreter-pinned "
+                "form (#1705).",
+                fg="yellow",
+            )
 
     if not has_baseline:
         sys.exit(4)
@@ -1427,6 +1446,29 @@ _ANTIGRAVITY_PRETOOL_MATCHER = "*"     # agy special-cases "*" (NOT RE2-compiled
 _KIRO_POSTTOOL_MATCHER = "*"           # observe-only postToolUse match-all
 
 
+def _pinned_hook_check_command() -> str:
+    """Interpreter-pinned `controlzero hook-check` command for Claude Code /
+    Gemini CLI / Codex CLI (#1705).
+
+    A bare ``controlzero hook-check`` is PATH-dependent: the agent's hook
+    subshell resolves ``controlzero`` against ITS PATH at hook-execution time,
+    not against the interpreter that ran ``install``. If a stale/older
+    ``controlzero`` binary (one whose only subcommands are
+    ``setup``/``status``/``uninstall``, i.e. pre-``hook-check``) sits earlier
+    on PATH than the one installed into this interpreter's venv, the hook
+    resolves to the wrong binary, prints ``invalid choice: 'hook-check'``,
+    exits non-zero, and the agent HARD-BLOCKS every tool call -- bricking the
+    session. This actually happened (#1705).
+
+    Pinning ``sys.executable -m controlzero`` -- the same fix #1265 shipped
+    for Cursor / kiro-cli -- makes the agent invoke the EXACT interpreter that
+    ran install, which provably has ``hook-check``, regardless of PATH or venv
+    activation. Double-quoted so a space in the interpreter path survives
+    /bin/sh and cmd.exe.
+    """
+    return f'"{sys.executable}" -m controlzero hook-check'
+
+
 @cli.command("hook-check")
 @click.option(
     "--policy",
@@ -3736,7 +3778,10 @@ def install_claude_code(force: bool, merge: bool, settings: Optional[str], api_k
     # env-prefix was a Windows-portability bug (PowerShell / cmd.exe cannot
     # parse the syntax) AND placed the cleartext key into settings.json on
     # disk. Both go away here. See 2026-05-12 incident.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` -- see
+    # _pinned_hook_check_command() (#1705: a stale controlzero earlier on
+    # PATH otherwise hard-blocks every tool call).
+    hook_command = _pinned_hook_check_command()
     new_block = {
         "matcher": _CLAUDE_CODE_PRETOOL_MATCHER,
         "hooks": [
@@ -3913,7 +3958,9 @@ def install_gemini_cli(force: bool, merge: bool, settings: Optional[str], api_ke
     # _write_api_key_config above). The legacy bash-only env-prefix
     # broke Windows; see the claude-code install path for the full
     # rationale.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` (#1705); see
+    # _pinned_hook_check_command().
+    hook_command = _pinned_hook_check_command()
 
     # Gemini CLI expects a nested structure:
     #   { matcher: "regex", hooks: [{ type: "command", command: "...", timeout: N }] }
@@ -4113,7 +4160,9 @@ def install_codex_cli(force: bool, merge: bool, config: Optional[str], api_key:
     # _write_api_key_config above). The legacy bash-only env-prefix
     # broke Windows; see the claude-code install path for the full
     # rationale.
-    hook_command = "controlzero hook-check"
+    # Interpreter-pinned, not a bare `controlzero hook-check` (#1705); see
+    # _pinned_hook_check_command().
+    hook_command = _pinned_hook_check_command()
 
     new_hook_entry = {
         "matcher": _CODEX_PRETOOL_MATCHER,

{controlzero-1.13.5 → controlzero-1.13.6}/controlzero/hook_integrity.py

@@ -63,12 +63,18 @@ from typing import Iterable, Optional
 from controlzero.tamper import load_or_create_secret, sign_bundle, verify_bundle
 
 # The CZ hook command is recognised by this substring on every host. Both
-# the bare ``controlzero hook-check`` form (Claude / Gemini / Codex /
-# Antigravity) and the interpreter-pinned ``"<py>" -m controlzero
-# hook-check --strict`` form (Cursor / Kiro CLI / Kiro v3) contain it, as
-# does the Kiro IDE adapter command (``-m controlzero.cli.kiro_adapter``).
+# the bare ``controlzero hook-check`` form and the interpreter-pinned
+# ``"<py>" -m controlzero hook-check [--strict]`` form contain it, as does
+# the Kiro IDE adapter command (``-m controlzero.cli.kiro_adapter``).
 # Keeping the marker broad means a renamed-but-still-CZ command still
 # matches, so an attacker cannot evade the baseline by reformatting.
+#
+# As of #1705, Claude Code / Gemini CLI / Codex CLI installs also emit the
+# interpreter-pinned form (previously only Cursor / Kiro CLI / Kiro v3 did;
+# Antigravity still emits bare). The bare form is kept recognised here on
+# purpose: an install from BEFORE #1705 (or a hand-edited config) still
+# carries it, and this marker is what lets `verify` / `uninstall` / a
+# re-`install` find and migrate it rather than treating it as untracked.
 HOOK_COMMAND_MARKERS = ("controlzero hook-check", "controlzero.cli.kiro_adapter")
 
 BASELINE_FILE_NAME = "hook_baseline.json"

{controlzero-1.13.5 → controlzero-1.13.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "controlzero"
-version = "1.13.5"
+version = "1.13.6"
 description = "AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{controlzero-1.13.5 → controlzero-1.13.6}/tests/test_cli_hook.py

@@ -1,12 +1,18 @@
 """Tests for `controlzero hook-check` and `controlzero install claude-code`."""
 
 import json
+import sys
 from pathlib import Path
 
 from click.testing import CliRunner
 
 from controlzero.cli.main import cli
 
+# #1705: the installer wires the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` command, not a bare
+# `controlzero hook-check` (PATH-shadowable).
+PINNED_HOOK_COMMAND = f'"{sys.executable}" -m controlzero hook-check'
+
 
 def write_policy(tmp_path: Path, rules: list) -> Path:
     p = tmp_path / "policy.yaml"
@@ -189,7 +195,7 @@ def test_install_claude_code_creates_files(tmp_path, monkeypatch):
     settings = json.loads(settings_path.read_text())
     pre_tool = settings["hooks"]["PreToolUse"]
     assert any(
-        h.get("command") == "controlzero hook-check"
+        h.get("command") == PINNED_HOOK_COMMAND
         for block in pre_tool
         for h in block.get("hooks", [])
     )
@@ -216,7 +222,7 @@ def test_install_claude_code_idempotent(tmp_path, monkeypatch):
         h
         for block in pre_tool
         for h in block.get("hooks", [])
-        if h.get("command") == "controlzero hook-check"
+        if h.get("command") == PINNED_HOOK_COMMAND
     ]
     assert len(cz_hooks) == 1, f"expected 1 cz hook, got {len(cz_hooks)}"
 
@@ -267,7 +273,7 @@ def test_install_claude_code_preserves_other_hooks(tmp_path, monkeypatch):
         for h in block.get("hooks", [])
     ]
     assert "some-other-tool" in commands
-    assert "controlzero hook-check" in commands
+    assert PINNED_HOOK_COMMAND in commands
 
 
 def test_install_claude_code_skips_existing_policy(tmp_path, monkeypatch):

{controlzero-1.13.5 → controlzero-1.13.6}/tests/test_coding_agent_hooks.py

@@ -39,6 +39,7 @@ from __future__ import annotations
 import importlib
 import json
 import os
+import sys
 from pathlib import Path
 
 import yaml
@@ -48,6 +49,12 @@ from controlzero._internal.enforcer import PolicyEvaluator
 from controlzero.cli.main import cli
 from controlzero.policy_loader import load_policy
 
+# #1705: the installer now wires the interpreter-pinned
+# `"<sys.executable>" -m controlzero hook-check` command, not a bare
+# `controlzero hook-check` (PATH-shadowable -- see main.py's
+# _pinned_hook_check_command()).
+PINNED_HOOK_COMMAND = f'"{sys.executable}" -m controlzero hook-check'
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -710,12 +717,13 @@ class TestApiKeyOption:
         pre_tool = settings["hooks"]["PreToolUse"]
         assert len(pre_tool) == 1
         hook_cmd = pre_tool[0]["hooks"][0]["command"]
-        # 1.5.2 portability fix: the hook command is plain
-        # `controlzero hook-check`. The api key flows through
+        # 1.5.2 portability fix: the api key flows through
         # ~/.controlzero/config.yaml (see _write_api_key_config) so it
         # is no longer embedded in settings.json (Windows shells could
-        # not parse the bash-only env-prefix syntax).
-        assert hook_cmd == "controlzero hook-check"
+        # not parse the bash-only env-prefix syntax). #1705: the command
+        # is the interpreter-pinned form, not a bare `controlzero
+        # hook-check` (PATH-shadowable).
+        assert hook_cmd == PINNED_HOOK_COMMAND
         assert "cz_live_" not in hook_cmd
         assert "CONTROLZERO_API_KEY=" not in hook_cmd
 
@@ -739,8 +747,8 @@ class TestApiKeyOption:
         # Nested format: check inside the hooks array
         inner_hooks = before_tool[0].get("hooks", [])
         assert len(inner_hooks) == 1
-        # 1.5.2: hook command is plain, key flows via config.yaml.
-        assert inner_hooks[0]["command"] == "controlzero hook-check"
+        # 1.5.2: key flows via config.yaml. #1705: interpreter-pinned command.
+        assert inner_hooks[0]["command"] == PINNED_HOOK_COMMAND
         assert "cz_test_" not in inner_hooks[0]["command"]
 
     def test_install_codex_cli_with_api_key_updates_hooks_json(
@@ -763,8 +771,8 @@ class TestApiKeyOption:
         assert len(pre_tool) == 1
         inner_hooks = pre_tool[0].get("hooks", [])
         assert len(inner_hooks) == 1
-        # 1.5.2: hook command is plain, key flows via config.yaml.
-        assert inner_hooks[0]["command"] == "controlzero hook-check"
+        # 1.5.2: key flows via config.yaml. #1705: interpreter-pinned command.
+        assert inner_hooks[0]["command"] == PINNED_HOOK_COMMAND
         assert "cz_live_" not in inner_hooks[0]["command"]
 
     def test_install_with_invalid_api_key_exits_with_error(