controlzero 1.9.4__tar.gz → 1.9.5__tar.gz

{controlzero-1.9.4 → controlzero-1.9.5}/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.9.5 -- 2026-06-16 (Kiro CLI -> GA, epic gh#877)
+
+### Changed
+
+- **Kiro CLI (`kiro-cli chat`) promoted BETA -> GA.** The CLI surface routes
+  the full event JSON (snake_case `tool_name` / `tool_input`) through the same
+  `controlzero hook-check` -> policy engine -> audit path Claude Code / Codex /
+  Gemini ship on, with argument-level deny rules and `agent="kiro"`
+  (`canonical_source="kiro_cli"`) attribution. The **Kiro IDE** surface stays
+  **limited preview**: upstream Kiro #6188 (open through IDE v0.12) delivers an
+  empty payload to IDE `preToolUse` hooks, so argument-level pre-tool blocking
+  is impossible IDE-side; the IDE Pre Tool Use hook still ships disabled.
+
+### Added
+
+- **`controlzero kiro verify`** -- install-validation self-test. Confirms the
+  Kiro CLI hook is wired into `settings.json` AND fires a synthetic known-deny
+  payload through the real hook to prove it blocks (exit 2). Exit 0 = installed
+  and enforcing; exit 1 = a problem (not wired, or a deny was not blocked).
+
+- **Strict mode for the Kiro CLI hook-check path (`CZ_KIRO_CLI_STRICT`).** When
+  set (the Kiro CLI installer wires it on by default), `hook-check` fails
+  **closed** (exit 2, with a cause-specific diagnostic) on empty stdin,
+  malformed JSON, a missing `tool_name`, or an installed-but-unreadable local
+  policy -- distinguishing "policy unreadable" from "no policy installed". The
+  Kiro CLI always delivers a well-formed payload, so such a payload is an
+  anomaly, not a benign passthrough. The default for every other host stays
+  fail-open so an agent is never bricked by a partial payload.
+
+### Fixed
+
+- Tightened the Kiro adapter docstring: IDE post-tool-use carries the tool
+  **name + result only** (`toolArgs` arrives empty, #6188), not the arguments.
+
 ## 1.9.4 -- 2026-06-16 (actionable E1101 / API-key-rejected message, #1254, epic gh#1247)
 
 ### Fixed
@@ -97,6 +131,7 @@ second-opinion). It is deliberately **narrow and gated**:
   bundle translator -> `PolicySettings`. Local YAML policies may set
   `settings.default_on_empty`. The dashboard observe-mode indicator +
   CLI `status` line remain a separate frontend/CLI follow-up.
+
 ## 1.9.1 -- 2026-06-16 (hosted-mode local audit log P0, epic gh#1247)
 
 ### Fixed

{controlzero-1.9.4 → controlzero-1.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.9.4
+Version: 1.9.5
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai
@@ -129,7 +129,7 @@ Templates available (`controlzero init -t <name>`):
 - `autogen` — AutoGen starter policy
 - `codex-cli` — Codex CLI hook starter
 - `gemini-cli` — Gemini CLI hook starter
-- `kiro` — Kiro (AWS IDE) hook starter (Beta)
+- `kiro` — Kiro (AWS) hook starter (CLI: GA; IDE: limited preview)
 - `antigravity` — Google Antigravity (IDE + `agy` CLI) hook starter (Beta)
 
 ## Loading a policy
@@ -225,14 +225,27 @@ to the Control Zero backend so your team can see it on the dashboard.
 
 ## Local audit log
 
-When running without an API key, every decision is written to `./controlzero.log`
-with daily rotation and 30-day retention. Tail it:
+Every decision (allow **and** deny) is written to a local audit log in **every
+mode** — local, hybrid, and hosted. The local log is never skipped, so
+`controlzero tail`, `cz debug-bundle`, and the tamper hash-chain always have a
+record to read.
 
 ```bash
 controlzero tail
 ```
 
-Configure rotation via the client:
+Default paths:
+
+- **Local / unenrolled mode** (no API key): `./controlzero.log`, with daily
+  rotation and 30-day retention.
+- **Hosted mode** (`CONTROLZERO_API_KEY` set): `~/.controlzero/audit.log` when you
+  do not pass an explicit `log_path`. Local audit is written **in addition to**
+  the remote dashboard sink, not instead of it — the remote sink is layered on
+  top. In hosted mode, PII and financial DLP `matched_text` is redacted from the
+  local plaintext row (the secret category is already hashed); the remote sink
+  keeps full fidelity.
+
+Configure rotation via the client (honoured in any mode):
 
 ```python
 cz = Client(
@@ -245,9 +258,6 @@ cz = Client(
 )
 ```
 
-When `CONTROLZERO_API_KEY` is set, audit ships to the remote dashboard and
-these `log_*` options are ignored with a warning.
-
 ## Hybrid mode
 
 Default (T103, 2026-05-12): when `CONTROLZERO_API_KEY` is set, the

{controlzero-1.9.4 → controlzero-1.9.5}/README.md

@@ -75,7 +75,7 @@ Templates available (`controlzero init -t <name>`):
 - `autogen` — AutoGen starter policy
 - `codex-cli` — Codex CLI hook starter
 - `gemini-cli` — Gemini CLI hook starter
-- `kiro` — Kiro (AWS IDE) hook starter (Beta)
+- `kiro` — Kiro (AWS) hook starter (CLI: GA; IDE: limited preview)
 - `antigravity` — Google Antigravity (IDE + `agy` CLI) hook starter (Beta)
 
 ## Loading a policy
@@ -171,14 +171,27 @@ to the Control Zero backend so your team can see it on the dashboard.
 
 ## Local audit log
 
-When running without an API key, every decision is written to `./controlzero.log`
-with daily rotation and 30-day retention. Tail it:
+Every decision (allow **and** deny) is written to a local audit log in **every
+mode** — local, hybrid, and hosted. The local log is never skipped, so
+`controlzero tail`, `cz debug-bundle`, and the tamper hash-chain always have a
+record to read.
 
 ```bash
 controlzero tail
 ```
 
-Configure rotation via the client:
+Default paths:
+
+- **Local / unenrolled mode** (no API key): `./controlzero.log`, with daily
+  rotation and 30-day retention.
+- **Hosted mode** (`CONTROLZERO_API_KEY` set): `~/.controlzero/audit.log` when you
+  do not pass an explicit `log_path`. Local audit is written **in addition to**
+  the remote dashboard sink, not instead of it — the remote sink is layered on
+  top. In hosted mode, PII and financial DLP `matched_text` is redacted from the
+  local plaintext row (the secret category is already hashed); the remote sink
+  keeps full fidelity.
+
+Configure rotation via the client (honoured in any mode):
 
 ```python
 cz = Client(
@@ -191,9 +204,6 @@ cz = Client(
 )
 ```
 
-When `CONTROLZERO_API_KEY` is set, audit ships to the remote dashboard and
-these `log_*` options are ignored with a warning.
-
 ## Hybrid mode
 
 Default (T103, 2026-05-12): when `CONTROLZERO_API_KEY` is set, the

{controlzero-1.9.4 → controlzero-1.9.5}/controlzero/__init__.py

@@ -40,7 +40,7 @@ from controlzero.hitl.grant_protocol import (
 )
 from controlzero.policy_loader import load_policy
 
-__version__ = "1.9.4"
+__version__ = "1.9.5"
 
 __all__ = [
     "Client",

controlzero-1.9.5/controlzero/cli/__main__.py

@@ -0,0 +1,13 @@
+"""Enable ``python -m controlzero.cli`` to run the Control Zero CLI.
+
+Mirrors the ``controlzero`` console-script entry point. Used by
+``controlzero kiro verify`` to invoke hook-check as a subprocess in a way
+that works even when the console script is not on PATH (e.g. CI, venvs).
+"""
+
+from __future__ import annotations
+
+from controlzero.cli.main import cli
+
+if __name__ == "__main__":
+    cli()

{controlzero-1.9.4 → controlzero-1.9.5}/controlzero/cli/hosts/kiro.py

@@ -22,10 +22,13 @@ correct.
    stdin shape before piping to hook-check, and sets ``CZ_KIRO_SURFACE=ide``
    so KiroIDEAdapter claims the call.
 
-Known upstream bug (kiro #7375 / #7408 / #7500): IDE ``preToolUse`` currently
-delivers ``USER_PROMPT={}`` with no tool context, so IDE argument-level
-pre-tool policy is bounded; prompt-submit and post-tool-use carry data. See
-docs/integrations/kiro-hook-payloads.md. Pin the validated Kiro version.
+Known upstream bug (kiro #6188 / #7375 / #7408 / #7500): IDE ``preToolUse``
+currently delivers ``USER_PROMPT={}`` with no tool context, so IDE
+argument-level pre-tool policy is bounded. Prompt-submit carries the raw
+prompt text; post-tool-use carries the tool *name + result only* (``toolArgs``
+arrives empty, #6188), so IDE post-tool data does not include the tool's
+arguments. See docs/integrations/kiro-hook-payloads.md. Pin the validated
+Kiro version.
 
 Note on adapter ordering: Claude Code matches PascalCase ``hook_event_name``
 (``PreToolUse``), Kiro CLI matches camelCase (``preToolUse``) -- byte-disjoint,

{controlzero-1.9.4 → controlzero-1.9.5}/controlzero/cli/main.py

@@ -686,21 +686,51 @@ def hook_check(policy: Optional[str]):
     Designed for Claude Code's PreToolUse hook system. Other agents that send a
     similar JSON-on-stdin protocol can reuse this command.
     """
+    # Strict mode (#1249 item 3): by default the hook-check CLI fails OPEN
+    # (exit 0) on empty-stdin / malformed-JSON / missing tool_name so a
+    # benign or truncated payload never bricks the host agent. That default
+    # is correct for hosts that can deliver malformed payloads (e.g. the
+    # Kiro IDE upstream empty-payload bug). The Kiro *CLI*, by contrast,
+    # always delivers a well-formed snake_case payload, so for that surface a
+    # missing tool_name is an anomaly that should be a deny, not a silent
+    # bypass. ``CZ_KIRO_CLI_STRICT`` (recommended default-on for Kiro CLI
+    # installs) flips those three cases to fail CLOSED (exit 2) with a
+    # specific diagnostic that distinguishes the cause. It does NOT change
+    # the hosted/tamper paths, which already fail closed.
+    _strict = _hook_check_strict()
+
     # Read stdin -- Claude Code passes the tool payload here
     try:
         raw = sys.stdin.read()
     except (KeyboardInterrupt, EOFError):
         # No payload: pass through (do not break the agent)
-        sys.exit(0)
+        sys.exit(2 if _strict else 0)
 
     if not raw.strip():
-        # Empty stdin: pass through
+        # Empty stdin.
+        if _strict:
+            click.echo(
+                "controlzero: empty hook payload on stdin; blocking "
+                "(CZ_KIRO_CLI_STRICT). The Kiro CLI always sends a payload -- "
+                "an empty one means the hook was misfired or stdin was lost.",
+                err=True,
+            )
+            sys.exit(2)
         sys.exit(0)
 
     try:
         payload = json.loads(raw)
     except json.JSONDecodeError as e:
-        # Malformed payload: log to stderr and pass through. Never brick the agent.
+        # Malformed payload.
+        if _strict:
+            click.echo(
+                f"controlzero: hook payload is not JSON ({e}); blocking "
+                f"(CZ_KIRO_CLI_STRICT). A well-formed payload is expected from "
+                f"the Kiro CLI -- refusing to fail open on a parse error.",
+                err=True,
+            )
+            sys.exit(2)
+        # Default: log to stderr and pass through. Never brick the agent.
         click.echo(f"controlzero: hook payload is not JSON ({e}); allowing", err=True)
         sys.exit(0)
 
@@ -727,6 +757,14 @@ def hook_check(policy: Optional[str]):
     tool_name = payload.get("tool_name") or payload.get("toolName") or ""
     tool_args = payload.get("tool_input") or payload.get("toolInput") or {}
     if not tool_name:
+        if _strict:
+            click.echo(
+                "controlzero: hook payload missing tool_name; blocking "
+                "(CZ_KIRO_CLI_STRICT). A security hook that cannot see which "
+                "tool is running must not fail open.",
+                err=True,
+            )
+            sys.exit(2)
         click.echo("controlzero: hook payload missing tool_name; allowing", err=True)
         sys.exit(0)
 
@@ -993,7 +1031,25 @@ def hook_check(policy: Optional[str]):
                 log_path=str(GLOBAL_AUDIT_PATH),
             )
     except (PolicyLoadError, PolicyValidationError, PermissionError, OSError) as e:
-        # Bad/unreadable policy file: log + allow (do not silently break the agent)
+        # Bad/unreadable policy file. Default: log + allow (do not silently
+        # break the agent). Strict mode: fail closed with a diagnostic that
+        # distinguishes an unreadable/parse-broken policy from "no policy
+        # installed" (which is the BUNDLE_MISSING path above and is governed
+        # by default_on_missing). An installed-but-unreadable policy is an
+        # operator error a security hook should not silently allow through.
+        if _strict:
+            click.echo(
+                f"controlzero: local policy is present but unreadable/invalid "
+                f"({e}); blocking (CZ_KIRO_CLI_STRICT). This is distinct from "
+                f"'no policy installed' -- fix or re-install the policy file.",
+                err=True,
+            )
+            _emit_decision(
+                effect="deny",
+                reason=f"[Control Zero] Local policy unreadable: {e}",
+                reason_code=REASON_CODE_BUNDLE_MISSING,
+            )
+            sys.exit(2)
         click.echo(f"controlzero: policy file invalid ({e}); allowing", err=True)
         sys.exit(0)
     except Exception as e:  # noqa: BLE001
@@ -1247,6 +1303,28 @@ def _resolve_default_on_missing() -> str:
     return DEFAULT_BUNDLE_ON_MISSING
 
 
+def _hook_check_strict() -> bool:
+    """True if the hook-check CLI should fail CLOSED (exit 2) on a
+    malformed/empty/missing payload or an unreadable local policy
+    instead of the default fail-open (exit 0).
+
+    Controlled by ``CZ_KIRO_CLI_STRICT`` (truthy: 1/true/yes/on). The
+    name is Kiro-scoped because the Kiro CLI is the surface this is
+    recommended-on for: it always delivers a well-formed snake_case
+    payload, so any empty/malformed/tool_name-less payload reaching the
+    hook is an anomaly that should be a deny, not a silent bypass.
+    ``controlzero kiro init`` enables it on Kiro CLI installs; other
+    hosts (which can legitimately deliver partial payloads) keep the
+    fail-open default so the agent is never bricked. Off when unset.
+    """
+    return (os.environ.get("CZ_KIRO_CLI_STRICT") or "").strip().lower() in (
+        "1",
+        "true",
+        "yes",
+        "on",
+    )
+
+
 def _append_event(event: dict) -> None:
     """Append a structured lifecycle event to ~/.controlzero/audit.log.
 
@@ -2067,8 +2145,10 @@ def install_claude_code(force: bool, merge: bool, settings: Optional[str], api_k
     click.echo("")
     click.echo("[Control Zero] Installed successfully.")
     click.echo("")
-    click.echo("  Default policy: ALLOW ALL (every tool call is permitted and logged)")
-    click.echo("  Add deny rules to block specific tools or patterns.")
+    click.echo("  Mode: OBSERVE-ONLY (audit on, enforcement off)")
+    click.echo("  Every tool call is logged to the audit log; nothing is blocked yet.")
+    click.echo("  This is the intended starting posture -- watch first, then enforce.")
+    click.echo("  To enforce, add deny rules above the catch-all in your policy.")
     click.echo("")
     click.echo("Test it:")
     click.echo("  1. Open Claude Code in any project")
@@ -3134,7 +3214,12 @@ _KIRO_IDE_HOOKS = (
 # tool use + prompt submit cover the block point, audit, and prompt scan.
 _KIRO_CLI_EVENTS = ("preToolUse", "postToolUse", "userPromptSubmit")
 
-_KIRO_CLI_HOOK_COMMAND = "controlzero hook-check"
+# Strict-by-default for Kiro CLI installs (#1249 item 3): the Kiro CLI always
+# delivers a well-formed snake_case payload, so an empty/malformed/tool_name-
+# less payload reaching the hook is an anomaly that should fail CLOSED rather
+# than silently allow. CZ_KIRO_CLI_STRICT=1 is set inline on the hook command
+# so it applies only to this surface (other hosts keep the fail-open default).
+_KIRO_CLI_HOOK_COMMAND = "CZ_KIRO_CLI_STRICT=1 controlzero hook-check"
 _KIRO_IDE_HOOK_TEMPLATE_DIR = TEMPLATE_DIR / "kiro"
 
 
@@ -3467,6 +3552,7 @@ def kiro_init(
     click.echo("")
     click.echo("Test it:")
     if surface in ("cli", "both"):
+        click.echo("  controlzero kiro verify  -> confirm the CLI hook is wired and blocks")
         click.echo("  Kiro CLI:  kiro-cli chat -> every tool call shows '[Control Zero] ...'")
     if surface in ("ide", "both"):
         click.echo("  Kiro IDE:  reload the workspace so Kiro picks up .kiro/hooks/")
@@ -3492,6 +3578,188 @@ def kiro_init(
     _print_api_key_status(api_key)
 
 
+def _kiro_cli_installed_command(settings_path: Path) -> Optional[str]:
+    """Return the EXACT `controlzero hook-check` command string Kiro will run
+    for preToolUse, read from the installed settings.json, or None if our hook
+    is not wired. `kiro verify` runs THIS string (through a shell, the way Kiro
+    does) so the self-test catches PATH / shell / inline-env / Windows
+    resolution failures that an in-process invocation would mask."""
+    if not settings_path.exists():
+        return None
+    try:
+        existing = json.loads(settings_path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        return None
+    if not isinstance(existing, dict):
+        return None
+    bucket = (existing.get("hooks") or {}).get("preToolUse") or []
+    if not isinstance(bucket, list):
+        return None
+    for block in bucket:
+        if not _kiro_cli_block_is_ours(block):
+            continue
+        for h in block.get("hooks") or []:
+            cmd = h.get("command") if isinstance(h, dict) else None
+            if isinstance(cmd, str) and "controlzero hook-check" in cmd:
+                return cmd
+    return None
+
+
+def _kiro_cli_hook_installed(settings_path: Path) -> bool:
+    """True if our `controlzero hook-check` block is wired into the Kiro CLI
+    settings.json preToolUse bucket. Mirrors the install idempotency check."""
+    return _kiro_cli_installed_command(settings_path) is not None
+
+
+@kiro.command("verify")
+@click.option(
+    "--settings",
+    type=click.Path(),
+    default=None,
+    help="Path to Kiro CLI settings.json. Defaults to ~/.kiro/settings.json.",
+)
+def kiro_verify(settings: Optional[str]) -> None:
+    """Self-test the Kiro CLI hook: confirm it is wired AND actually blocks.
+
+    Fires a synthetic known-deny tool call through the real
+    `controlzero hook-check` path (the exact command Kiro CLI invokes) and
+    asserts it exits 2 (block). Also fires a result-only postToolUse payload
+    and asserts it does NOT spuriously block. Prints a green/red summary.
+
+    Exit 0 = the hook is installed and enforcing; exit 1 = a problem was
+    found (not wired, or a deny payload was not blocked). This is the
+    install-validation command for a Kiro CLI GA install.
+    """
+    import subprocess
+    import tempfile
+
+    settings_path = (
+        Path(settings) if settings else Path.home() / ".kiro" / "settings.json"
+    )
+
+    ok = True
+
+    # Check 1: is our hook wired into the CLI settings.json? Capture the EXACT
+    # command string Kiro will run so checks 2/3 exercise it verbatim.
+    installed_cmd = _kiro_cli_installed_command(settings_path)
+    if installed_cmd is not None:
+        click.echo(f"  [PASS] Kiro CLI hook wired in {settings_path}")
+    else:
+        ok = False
+        click.echo(
+            f"  [FAIL] Kiro CLI hook NOT found in {settings_path}. "
+            "Run `controlzero kiro init --surface cli` first.",
+            err=True,
+        )
+
+    # Check 2 + 3: fire synthetic payloads against a deterministic deny policy
+    # (a sentinel deny + catch-all allow) so the result does not depend on the
+    # user's installed policy. We run the EXACT installed command string through
+    # the same shell Kiro uses -- so a `controlzero`-not-on-PATH, a non-POSIX
+    # shell, or an unsupported inline `VAR=1 cmd` on Windows is CAUGHT here
+    # rather than silently passing. When the hook is not installed we fall back
+    # to the in-process module form purely to still exercise the engine, and we
+    # SAY SO, because that fallback does not prove Kiro can resolve the command.
+    sentinel = "controlzero_kiro_verify_sentinel"
+    use_real_cmd = installed_cmd is not None
+    if not use_real_cmd:
+        click.echo(
+            "  [WARN] hook not installed; running the engine via "
+            "`python -m controlzero.cli` -- this proves the policy blocks but "
+            "NOT that Kiro can resolve the installed command. Install first "
+            "for a full verify.",
+            err=True,
+        )
+    with tempfile.TemporaryDirectory() as td:
+        pol = Path(td) / "verify-policy.yaml"
+        pol.write_text(
+            yaml.safe_dump(
+                {
+                    "version": "1",
+                    "rules": [
+                        {"deny": sentinel, "reason": "kiro verify self-test deny"},
+                        {"allow": "*"},
+                    ],
+                }
+            ),
+            encoding="utf-8",
+        )
+
+        def _run(payload: dict) -> int:
+            env = dict(os.environ)
+            env["CZ_KIRO_CLI_STRICT"] = "1"
+            if use_real_cmd:
+                # Run the literal installed string through a shell, exactly as
+                # Kiro executes its `type: "command"` hooks. Append --policy so
+                # the decision is deterministic regardless of the user's policy.
+                # The `CZ_KIRO_CLI_STRICT=1` prefix already in the string is
+                # harmless to re-set via env; the shell honors both.
+                cmd = f'{installed_cmd} --policy "{pol}"'
+                proc = subprocess.run(
+                    cmd,
+                    shell=True,
+                    input=json.dumps(payload),
+                    text=True,
+                    capture_output=True,
+                    env=env,
+                )
+            else:
+                proc = subprocess.run(
+                    [sys.executable, "-m", "controlzero.cli", "hook-check",
+                     "--policy", str(pol)],
+                    input=json.dumps(payload),
+                    text=True,
+                    capture_output=True,
+                    env=env,
+                )
+            return proc.returncode
+
+        deny_payload = {
+            "hook_event_name": "preToolUse",
+            "tool_name": sentinel,
+            "tool_input": {"command": "rm -rf /"},
+        }
+        rc_deny = _run(deny_payload)
+        if rc_deny == 2:
+            click.echo("  [PASS] synthetic preToolUse deny -> blocked (exit 2)")
+        else:
+            ok = False
+            click.echo(
+                f"  [FAIL] synthetic preToolUse deny was NOT blocked "
+                f"(exit {rc_deny}, expected 2). The hook is not enforcing.",
+                err=True,
+            )
+
+        # postToolUse carries a result, not a fresh pre-tool decision; a deny
+        # rule on the tool name should still not let a result-only event ride
+        # as a block surprise. We send the sentinel under postToolUse and only
+        # assert it does not error out unexpectedly (exit 0 or 2 are both valid
+        # given the deny rule; a crash / other code is the failure).
+        result_payload = {
+            "hook_event_name": "postToolUse",
+            "tool_name": "fs_read",
+            "tool_input": {},
+            "tool_response": {"ok": True},
+        }
+        rc_post = _run(result_payload)
+        if rc_post == 0:
+            click.echo("  [PASS] benign postToolUse result -> not blocked (exit 0)")
+        else:
+            ok = False
+            click.echo(
+                f"  [FAIL] benign postToolUse result unexpectedly returned "
+                f"exit {rc_post} (expected 0).",
+                err=True,
+            )
+
+    click.echo("")
+    if ok:
+        click.echo("[Control Zero] Kiro CLI verify: PASS -- hook installed and enforcing.")
+        sys.exit(0)
+    click.echo("[Control Zero] Kiro CLI verify: FAIL -- see findings above.", err=True)
+    sys.exit(1)
+
+
 # Register the `controlzero debug ...` subcommand group. Defined in
 # controlzero.cli.debug_bundle to keep the bundle-inspection logic
 # isolated from the existing CLI body. Today the group exposes the

{controlzero-1.9.4 → controlzero-1.9.5}/controlzero/cli/templates/claude-code.yaml

@@ -5,6 +5,21 @@
 # ALLOW-BY-DEFAULT and lists explicit deny rules. The goal: visible audit
 # from day one, with a few opinionated denies you can extend.
 #
+# MODE: OBSERVE-ONLY (audit on, enforcement off).
+#   The catch-all `allow: '*'` at the BOTTOM of this file means every tool
+#   call is allowed AND logged. Nothing is blocked yet -- this is the
+#   intended starting posture: watch first, then enforce. To enforce, add
+#   deny rules ABOVE the catch-all (examples are commented below). You are
+#   not yet blocking anything; you are recording everything.
+#
+# HEADS UP -- local default vs hosted default differ on purpose:
+#   This LOCAL template ends with `allow: '*'`, so an unmatched tool is
+#   ALLOWED (observe-only). A HOSTED/dashboard policy has NO catch-all and
+#   defaults to DENY on an unmatched tool (`default_action: deny`). So a
+#   hosted "block deletes" policy will also block Bash/Read/etc unless you
+#   add a catch-all `allow: '*'` rule or set `default_action: allow`.
+#   See the "Enforcement Behavior" concept doc (default_action / NO_RULE_MATCH).
+#
 # Where this file lives:
 #   ~/.controlzero/policy.yaml
 #

{controlzero-1.9.4 → controlzero-1.9.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "controlzero"
-version = "1.9.4"
+version = "1.9.5"
 description = "AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup."
 readme = "README.md"
 license = {text = "Apache-2.0"}