controlzero 1.7.0__tar.gz → 1.8.0__tar.gz

controlzero-1.8.0/.gitignore

@@ -0,0 +1,255 @@
+# Worktrees
+.worktrees/
+
+# Preflight state (drift-confirmed marker etc.). Local-only, never committed.
+.preflight-state/
+
+# Transient QA / design captures at repo root.
+# Long-term reference screenshots live under docs-site/static/ or in Obsidian.
+/*.png
+/dashboard-*.md
+/uat-*.png
+/audit-*.png
+/billing-*.png
+/sso-*.png
+/notifications-*.png
+/settings-*.png
+
+# Dependencies
+node_modules/
+vendor/
+
+# Build outputs
+dist/
+build/
+.next/
+out/
+*.egg-info/
+# Go binaries
+apps/control-zero-platform/backend/server
+
+# Test & Coverage
+coverage/
+htmlcov/
+.coverage
+*.lcov
+.pytest_cache/
+.vitest/
+test-results/
+playwright-report/
+.playwright/
+__pycache__/
+*.pyc
+*.pyo
+
+# Environment and secrets (deny-all, allow explicitly)
+.env*
+!.envrc
+production-secrets*
+vault-backup.key
+*.pem
+*.key
+*.p12
+*.pfx
+id_rsa
+id_ed25519
+*.keystore
+# Firebase credentials and config (contains API keys / service account)
+firebase.js
+firebase.json
+firebase-service-account*.json
+*-firebase-adminsdk-*.json
+firebase-adminsdk-*.json
+serviceAccountKey.json
+cz-service-account.json
+firebase-credentials.json/
+google-services.json
+GoogleService-Info.plist
+!*.pub
+!.env.example
+!.env.local.example
+!.env.production.template
+!.env.production.example
+!.env.test
+
+# Explicitly block files that contain or may contain real credentials (override allowlist above)
+.env.dev
+.env.production
+.env.production.complete
+.env.production.local
+.env.local
+.env.*.local
+*.env.real
+*.env.secret
+.env.vercel
+
+# IDE & Editors
+.idea/
+.vscode/
+*.swp
+*.swo
+*.sublime-workspace
+*.sublime-project
+
+# OS files
+.DS_Store
+Thumbs.db
+*.log
+
+# Go
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Docker
+docker-compose.override.yml
+.docker/
+
+# Production logs and certificates
+logs/
+letsencrypt/
+*.log
+
+# DLP test reports (generated, not committed)
+reports/
+# ...but committed long-form markdown reports under docs/reports/ are kept
+!docs/reports/
+!docs/reports/**/*.md
+
+# MkDocs
+site/
+
+# Turbo (if adopted)
+.turbo/
+
+# Changeset
+.changeset/*.md
+!.changeset/config.json
+!.changeset/README.md
+
+# Vercel
+.vercel/
+
+# Rust
+target/
+Cargo.lock
+*.rlib
+
+# Python virtual environments
+venv/
+.venv/
+*.egg-info/
+
+# Gateway
+apps/control-zero-gateway/.venv/
+apps/control-zero-gateway/__pycache__/
+
+# Selenium test outputs
+tests/selenium/screenshots/
+tests/selenium/report.html
+
+# Miscellaneous
+*.bak
+*.tmp
+*.temp
+.cache/
+.vercel
+# Internal documentation (sensitive -- do not track)
+docs/internal/
+
+# Playwright MCP
+.playwright-mcp/
+
+# Session artifacts (prevent future accumulation)
+*_SUMMARY.md
+*_STATUS.md
+*_COMPLETE.md
+
+# E2E test screenshots
+e2e-*.png
+cz-*.png
+.superpowers/
+
+# AI tooling directories
+.gemini/
+.claude/launch.json
+
+# Docusaurus build cache (should not be tracked)
+docs-site/.docusaurus/
+
+# Test/governance tester scripts (generated during testing sessions)
+*_tester.py
+verify_and_screenshot.js
+
+# HTML reports generated during testing sessions
+*_AUDIT.html
+*_REPORT.html
+*_ANALYSIS.html
+e2e-report.html
+sit-uat-report.html
+UAT_COMPREHENSIVE_REPORT.html
+uat-screenshots/
+
+# Offensive summary reports
+SUMMARY_OFFENSIVE_*.md
+.gstack/
+
+# Deployment docs (contain server-specific credentials)
+docs/deployment/
+docs/SSH_RECOVERY_GUIDE.md
+docs/HETZNER_OS_INSTALLATION.md
+docs/VERCEL_SETUP_WEBAPPS.md
+scripts/fix-ssh-config.sh
+scripts/hetzner-post-install.sh
+docs/knowledge-base/
+docs/superpowers/
+# Air-gap build artifacts (generated tarballs and package directories)
+cz-air-gap-*/
+cz-air-gap-*.tar.gz
+cz-support-*.tar.gz
+
+# SSL Proxy -- customer CA certs and generated certs (never track secrets)
+services/ssl-proxy/certs/
+
+# UAT screenshot artifacts
+uat-*.png
+
+# Stray HTML reports in docs/. These are large exported artifacts
+# (SIT/UAT reports, factsheet, launch readiness) that accumulate
+# untracked and risk being swept up by `git add .`. The
+# sit-uat-report-2026-03-22.html in particular is 128MB and would
+# explode the repo. Real docs go under docs/knowledge-base/ or
+# docs/designs/ instead.
+docs/sit-uat-report-*.html
+docs/launch-readiness-report-*.html
+docs/control-zero-factsheet.html
+docs/control-zero-review.html
+
+# Reference screenshots (keep local, not in repo)
+agentdefenders-full.png
+cz-revamp-live.png
+
+# Agent worktrees (created by Claude Code during parallel work)
+.claude/worktrees/
+
+# direnv + sops secrets. Encrypted files under secrets/ are safe to
+# commit; anything matching *.plain or *.dec is a decryption artifact
+# and must NEVER land in git.
+.envrc.local
+.direnv/
+secrets/*.plain
+secrets/*.dec
+.claude/scheduled_tasks.lock
+
+# Local documentation, patent assets, and legal research (sensitive, never commit)
+doc_local/
+
+# Go build/module caches (generated by `go build`, `go test`, etc.)
+**/.gocache/
+**/.gomodcache/
+/node_modules
+
+# Antigravity (agy) CLI local workspace
+.antigravitycli/

{controlzero-1.7.0 → controlzero-1.8.0}/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 1.8.0 -- 2026-06-15 (Kiro, epic gh#877)
+
+### Added
+
+- **Kiro (AWS agentic IDE) governance.** Control Zero now governs Kiro the
+  same way it governs Claude Code / Codex / Gemini: tool calls route through
+  the shared `controlzero hook-check` -> policy engine -> audit path, with
+  project scope honored and audit rows attributed to `agent="kiro"`
+  (`canonical_source` `kiro_cli` / `kiro_ide`).
+
+  - **Kiro CLI (`kiro-cli chat`): BETA -- full fidelity.** The CLI passes the
+    event JSON on stdin in snake_case, byte-compatible with what hook-check
+    already consumes, so `preToolUse` / `postToolUse` / `userPromptSubmit`
+    governance (including argument-level deny rules) works directly. The new
+    `KiroCLIAdapter` claims these by their camelCase event names, which are
+    byte-disjoint from Claude Code's PascalCase events.
+
+  - **Kiro IDE: limited (see below).** The IDE delivers its hook payload via
+    the `USER_PROMPT` env var, not stdin. The packaged `cz-kiro-adapter`
+    console script normalises that to the stdin shape and pipes it to
+    hook-check. **The Prompt Submit and File Save hooks are active** (they
+    carry data). **The Pre Tool Use hook ships DISABLED** because upstream
+    Kiro (#7375/#7408/#7500, IDE v0.11) currently delivers an empty payload
+    (`USER_PROMPT={}`) to IDE `preToolUse` run-command hooks -- with no tool
+    context, an enabled hook would fail closed and block every tool call.
+    Re-enable it once upstream ships tool context (or set
+    `CZ_KIRO_UNKNOWN_PAYLOAD=open` to trade pre-tool policy for availability).
+
+  - **`controlzero kiro init`** one-command installer (`--surface cli|ide|both`,
+    idempotent, `--dry-run`, `--uninstall`). Writes the Kiro hook configs from
+    committed templates, installs the `~/.controlzero/policy.yaml` Kiro
+    template, and registers the Kiro agent fingerprint.
+
+  - **Fail-safe defaults.** The IDE shim never crashes the IDE: an empty /
+    unparseable payload is handled per `CZ_KIRO_UNKNOWN_PAYLOAD`
+    (default `closed` = block, governance-safe), and a missing `controlzero`
+    CLI allows rather than bricking the editor.
+
+  See `docs/integrations/kiro.md` for the covered-vs-bounded matrix and
+  `docs/integrations/kiro-hook-payloads.md` for the per-event payload shapes.
+
 ## 1.7.0 -- 2026-05-19 (T86, gh#391)
 
 ### Added

{controlzero-1.7.0 → controlzero-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.7.0
+Version: 1.8.0
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai
@@ -52,7 +52,7 @@ Provides-Extra: openai
 Requires-Dist: openai>=1.0.0; extra == 'openai'
 Description-Content-Type: text/markdown
 
-# control-zero
+# controlzero
 
 AI agent governance for Python. Policies, audit, and observability for tool calls.
 Works locally with no signup.
@@ -116,12 +116,19 @@ The generated `controlzero.yaml` is the tutorial. It ships with annotated
 rules covering the common patterns: allow lists, deny lists, wildcards, and
 the catch-all.
 
-Templates available:
+Templates available (`controlzero init -t <name>`):
 
-- `controlzero init` — Hello World template (default)
-- `controlzero init -t rag` — RAG agent template (block exfiltration)
-- `controlzero init -t mcp` — MCP server template
-- `controlzero init -t cost-cap` — model allow-listing and cost guards
+- `generic` — Hello World template (default)
+- `rag` — RAG agent template (block exfiltration)
+- `mcp` — MCP server template
+- `cost-cap` — model allow-listing and cost guards
+- `claude-code` — Claude Code hook starter
+- `langchain` — LangChain tool guardrails
+- `crewai` — CrewAI starter policy
+- `cursor` — Cursor / editor hook starter
+- `autogen` — AutoGen starter policy
+- `codex-cli` — Codex CLI hook starter
+- `gemini-cli` — Gemini CLI hook starter
 
 ## Loading a policy
 
@@ -368,7 +375,7 @@ async def async_poll(request_id: str) -> dict:
 resolved = await pending.wait_async(async_poll)
 ```
 
-A built-in HTTP poller is planned for 1.7.0.
+1.7.0 ships `client.get_secret_poll_fn()` as a built-in poller helper for the secret-read approval path. The general `request_approval()` flow still takes an explicit `poll_fn` so callers can plug their own HTTP stack.
 
 ### Mock backend for tests
 

{controlzero-1.7.0 → controlzero-1.8.0}/README.md

@@ -1,4 +1,4 @@
-# control-zero
+# controlzero
 
 AI agent governance for Python. Policies, audit, and observability for tool calls.
 Works locally with no signup.
@@ -62,12 +62,19 @@ The generated `controlzero.yaml` is the tutorial. It ships with annotated
 rules covering the common patterns: allow lists, deny lists, wildcards, and
 the catch-all.
 
-Templates available:
+Templates available (`controlzero init -t <name>`):
 
-- `controlzero init` — Hello World template (default)
-- `controlzero init -t rag` — RAG agent template (block exfiltration)
-- `controlzero init -t mcp` — MCP server template
-- `controlzero init -t cost-cap` — model allow-listing and cost guards
+- `generic` — Hello World template (default)
+- `rag` — RAG agent template (block exfiltration)
+- `mcp` — MCP server template
+- `cost-cap` — model allow-listing and cost guards
+- `claude-code` — Claude Code hook starter
+- `langchain` — LangChain tool guardrails
+- `crewai` — CrewAI starter policy
+- `cursor` — Cursor / editor hook starter
+- `autogen` — AutoGen starter policy
+- `codex-cli` — Codex CLI hook starter
+- `gemini-cli` — Gemini CLI hook starter
 
 ## Loading a policy
 
@@ -314,7 +321,7 @@ async def async_poll(request_id: str) -> dict:
 resolved = await pending.wait_async(async_poll)
 ```
 
-A built-in HTTP poller is planned for 1.7.0.
+1.7.0 ships `client.get_secret_poll_fn()` as a built-in poller helper for the secret-read approval path. The general `request_approval()` flow still takes an explicit `poll_fn` so callers can plug their own HTTP stack.
 
 ### Mock backend for tests
 

{controlzero-1.7.0 → controlzero-1.8.0}/controlzero/__init__.py

@@ -27,13 +27,33 @@ from controlzero.errors import (
     PolicyValidationError,
 )
 from controlzero.hitl import PendingApproval
+from controlzero.hitl.grant_protocol import (
+    REASON_HITL_BACKEND_UNREACHABLE,
+    REASON_HITL_GRANT_APPROVED,
+    REASON_HITL_GRANT_CANCELED,
+    REASON_HITL_GRANT_DENIED,
+    REASON_HITL_GRANT_EXPIRED,
+    REASON_HITL_GRANT_REVOKED,
+    REASON_HITL_GRANT_TIMEOUT,
+    REASON_HITL_RETRY_GUARD_FAILED,
+    REASON_HITL_RETRY_LOOP,
+)
 from controlzero.policy_loader import load_policy
 
-__version__ = "1.7.0"
+__version__ = "1.8.0"
 
 __all__ = [
     "Client",
     "PendingApproval",
+    "REASON_HITL_BACKEND_UNREACHABLE",
+    "REASON_HITL_GRANT_APPROVED",
+    "REASON_HITL_GRANT_CANCELED",
+    "REASON_HITL_GRANT_DENIED",
+    "REASON_HITL_GRANT_EXPIRED",
+    "REASON_HITL_GRANT_REVOKED",
+    "REASON_HITL_GRANT_TIMEOUT",
+    "REASON_HITL_RETRY_GUARD_FAILED",
+    "REASON_HITL_RETRY_LOOP",
     "PolicyDecision",
     "PolicyDeniedError",
     "PolicyLoadError",

{controlzero-1.7.0 → controlzero-1.8.0}/controlzero/_internal/bundle.py

@@ -570,7 +570,7 @@ def translate_to_local_policy(payload: dict) -> dict:
             "reason_code": "NO_ACTIVE_POLICIES",
         })
 
-    return {
+    out = {
         "version": "1",
         "rules": flat,
         "settings": {
@@ -580,6 +580,20 @@ def translate_to_local_policy(payload: dict) -> dict:
         },
     }
 
+    # #906 / #907 Phase 2 seam (hosted path): carry the bundle-level
+    # ``dlp_rules`` array through to the translated local-policy dict under
+    # the SAME key the scanner reads (load_dlp_rules_from_policy reads
+    # ``dlp_rules``). Without this, a bundle-projected custom DLP rule reaches
+    # the hosted ``Client(api_key=...)`` path (via _get_raw_policy_data ->
+    # load_dlp_rules_from_policy) as nothing, so only the CLI /api/policy path
+    # would enforce custom rules. Only emit the key when present so the
+    # translated shape stays byte-identical for bundles without dlp_rules.
+    bundle_dlp_rules = payload.get("dlp_rules")
+    if isinstance(bundle_dlp_rules, list) and bundle_dlp_rules:
+        out["dlp_rules"] = bundle_dlp_rules
+
+    return out
+
 
 def make_bundle_missing_policy(
     default_on_missing: Optional[str] = None,

{controlzero-1.7.0 → controlzero-1.8.0}/controlzero/_internal/enforcer.py

@@ -206,6 +206,17 @@ class PolicyDecision:
     # makes spoof attempts and selector misconfigurations
     # indistinguishable in the dashboard.
     gate_matched: str = "none"
+    # HITL Phase 2b grants protocol (gh#820 SDK follow-up). The
+    # compiled policy engine sets requires_approval=True when the
+    # matched function appears in the require_approval set. The SDK
+    # then drives the grants flow (POST /api/grants + poll). Both
+    # fields default to the non-HITL shape so any decision built
+    # without them behaves exactly as before (backward compatible).
+    requires_approval: bool = False
+    # Canonical action label shipped to the grants endpoint when
+    # requires_approval is True. None falls back to policy_id at
+    # request time so the approver always sees a label.
+    approval_action: Optional[str] = None
 
     @property
     def decision(self) -> str: