sernixa-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/PKG-INFO

@@ -1,9 +1,10 @@
 Metadata-Version: 2.4
 Name: sernixa-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: Official Sernixa CLI for policy-governed local AI agent actions
 Author: Sernixa Team
 License-Expression: MIT
+Project-URL: Changelog, https://github.com/abhishekdhull63/Sernixa.ai-Web/tree/main/apps/cli/CHANGELOG.md
 Project-URL: Homepage, https://sernixa.com
 Project-URL: Repository, https://github.com/abhishekdhull63/Sernixa.ai-Web
 Project-URL: Documentation, https://github.com/abhishekdhull63/Sernixa.ai-Web/tree/main/docs/cli.md
@@ -20,7 +21,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: platformdirs>=4.0.0
 Requires-Dist: sernixa>=0.4.0
-Requires-Dist: sernixa-agent>=1.6.0
+Requires-Dist: sernixa-agent>=1.6.1
 Requires-Dist: typer>=0.12.0
 
 # Sernixa CLI
@@ -33,7 +34,7 @@ The official terminal and local-agent integration for Sernixa governance. The CL
 pip install --upgrade sernixa-cli
 sernixa auth login
 sernixa setup
-sernixa doctor
+sernixa doctor --strict
 ```
 
 `sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
@@ -85,11 +86,13 @@ sernixa hook install codex
 sernixa hook install cursor
 
 sernixa hook repair codex
-sernixa hook status --json
+sernixa hook status
 ```
 
 Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. An API/configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback.
 
+Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
+
 Claude Desktop and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
@@ -117,6 +120,8 @@ Exit codes are stable:
 - `1`: deny, review required, invalid evidence, or non-success terminal result
 - `2`: configuration, parsing, auth, network, or API failure
 
+Human output is intentionally concise. Use `--json` only when a script needs structured details; JSON decisions omit the duplicated raw backend payload.
+
 `validate-plan` calls the canonical plan endpoint. `exec` and `codex-exec` run the child command only after every planned step is allowed and bound to its proof.
 
 ## Audit, approvals, and Flight Recorder
@@ -139,6 +144,7 @@ These commands call the authenticated organization endpoints and inherit backend
 ## Stable configuration overrides
 
 - `SERNIXA_CONFIG_FILE`
+- `SERNIXA_CLI_TIMEOUT_SECONDS`
 - `SERNIXA_PLAN_SESSION_FILE`
 - `SERNIXA_CLAUDE_CONFIG_FILE`
 - `SERNIXA_CLAUDE_DESKTOP_CONFIG_FILE`

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/README.md

@@ -8,7 +8,7 @@ The official terminal and local-agent integration for Sernixa governance. The CL
 pip install --upgrade sernixa-cli
 sernixa auth login
 sernixa setup
-sernixa doctor
+sernixa doctor --strict
 ```
 
 `sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
@@ -60,11 +60,13 @@ sernixa hook install codex
 sernixa hook install cursor
 
 sernixa hook repair codex
-sernixa hook status --json
+sernixa hook status
 ```
 
 Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execution. `allow` continues through normal host permissions and `deny` blocks. Claude Code maps `review` to its supported human prompt. Current Codex `PreToolUse` does not support an `ask` result, so Sernixa maps `review` to a fail-closed deny with an explicit human-review reason instead of returning a hook shape that Codex would ignore. An API/configuration failure exits with code `2`, which both hosts treat as blocking; there is no local allow fallback.
 
+Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
+
 Claude Desktop and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
@@ -92,6 +94,8 @@ Exit codes are stable:
 - `1`: deny, review required, invalid evidence, or non-success terminal result
 - `2`: configuration, parsing, auth, network, or API failure
 
+Human output is intentionally concise. Use `--json` only when a script needs structured details; JSON decisions omit the duplicated raw backend payload.
+
 `validate-plan` calls the canonical plan endpoint. `exec` and `codex-exec` run the child command only after every planned step is allowed and bound to its proof.
 
 ## Audit, approvals, and Flight Recorder
@@ -114,6 +118,7 @@ These commands call the authenticated organization endpoints and inherit backend
 ## Stable configuration overrides
 
 - `SERNIXA_CONFIG_FILE`
+- `SERNIXA_CLI_TIMEOUT_SECONDS`
 - `SERNIXA_PLAN_SESSION_FILE`
 - `SERNIXA_CLAUDE_CONFIG_FILE`
 - `SERNIXA_CLAUDE_DESKTOP_CONFIG_FILE`

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sernixa-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "Official Sernixa CLI for policy-governed local AI agent actions"
 readme = "README.md"
 license = "MIT"
@@ -20,11 +20,12 @@ classifiers = [
 dependencies = [
     "platformdirs>=4.0.0",
     "sernixa>=0.4.0",
-    "sernixa-agent>=1.6.0",
+    "sernixa-agent>=1.6.1",
     "typer>=0.12.0",
 ]
 
 [project.urls]
+Changelog = "https://github.com/abhishekdhull63/Sernixa.ai-Web/tree/main/apps/cli/CHANGELOG.md"
 Homepage = "https://sernixa.com"
 Repository = "https://github.com/abhishekdhull63/Sernixa.ai-Web"
 Documentation = "https://github.com/abhishekdhull63/Sernixa.ai-Web/tree/main/docs/cli.md"

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/sernixa_cli/__init__.py

@@ -1,3 +1,3 @@
 """Official Sernixa command-line client."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/sernixa_cli/discovery.py

@@ -44,7 +44,7 @@ def _agent_executable() -> str:
     executable = shutil.which("sernixa-agent")
     if not executable:
         raise DiscoveryError(
-            "sernixa-agent is not installed. Upgrade sernixa-cli or install sernixa-agent>=1.6.0."
+            "sernixa-agent is not installed. Upgrade sernixa-cli or install sernixa-agent>=1.6.1."
         )
     return executable
 
@@ -155,14 +155,14 @@ def run_discovery(
     agent_run = _run_agent(
         [
             executable,
-            "daemon",
+            "tasks-once",
             "--config",
             str(config_path),
             "--api-base-url",
             config.base_url,
             "--token-env",
             "SERNIXA_DISCOVERY_TOKEN",
-            "--once",
+            "--json",
         ],
         extra_env=agent_env,
     )

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/sernixa_cli/formatting.py

@@ -20,7 +20,7 @@ def exit_code_for_decision(decision: dict[str, Any]) -> int:
 def decision_summary(
     backend_decision: dict[str, Any],
     *,
-    include_raw: bool = True,
+    include_raw: bool = False,
     request: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     allowed = is_allowed(backend_decision)
@@ -60,51 +60,34 @@ def render_decision(
         )
         return
     if allowed:
-        typer.secho("Allowed by Sernixa policy.", fg=typer.colors.GREEN)
-        matched = backend_decision.get("matched_policies") or []
-        if matched:
-            typer.echo(f"Matched policies: {', '.join(str(item) for item in matched)}")
+        typer.secho("ALLOW", fg=typer.colors.GREEN)
         return
     review_required = (
         str(backend_decision.get("final_decision") or "").casefold() == "review"
     )
+    violations = _violations(backend_decision, request=request)
+    primary = violations[0] if violations else {}
+    category = primary.get("risk_category") or primary.get("category")
+    severity = primary.get("severity")
+    heading = "REVIEW" if review_required else "DENY"
+    details = [str(item) for item in (category, severity) if item]
+    if details:
+        heading = f"{heading} · {' · '.join(details)}"
     typer.secho(
-        "Human review required by Sernixa policy."
-        if review_required
-        else "Denied by Sernixa policy.",
+        heading,
         fg=typer.colors.YELLOW if review_required else typer.colors.RED,
         err=True,
     )
-    for violation in _violations(backend_decision, request=request):
-        label = (
-            violation.get("policy_id")
-            or violation.get("rule")
-            or violation.get("principle")
-            or "policy"
-        )
-        category = violation.get("risk_category") or violation.get("category")
-        severity = violation.get("severity")
-        message = (
-            violation.get("message") or violation.get("reason") or "Denied by policy."
-        )
-        prefix = f"{label}"
-        if category:
-            prefix = f"{prefix} [{category}]"
-        if severity:
-            prefix = f"{prefix} severity={severity}"
-        typer.echo(f"- {prefix}: {message}", err=True)
-        if violation.get("principle"):
-            typer.echo(f"  principle: {violation['principle']}", err=True)
-        if category:
-            typer.echo(f"  risk category: {category}", err=True)
-        if violation.get("severity"):
-            typer.echo(f"  severity: {violation['severity']}", err=True)
-        if violation.get("resource"):
-            typer.echo(f"  resource: {violation['resource']}", err=True)
-        if violation.get("action"):
-            typer.echo(f"  action: {violation['action']}", err=True)
-        if violation.get("remediation"):
-            typer.echo(f"  remediation: {violation['remediation']}", err=True)
+    message = primary.get("message") or primary.get("reason")
+    if not message:
+        reasons = backend_decision.get("reasons") or []
+        message = reasons[0] if reasons else "Blocked by policy."
+    typer.echo(f"Reason: {message}", err=True)
+    remediation = primary.get("remediation") or _first_remediation(
+        backend_decision.get("remediation")
+    )
+    if remediation:
+        typer.echo(f"Next: {remediation}", err=True)
 
 
 def hook_response(

{sernixa_cli-0.2.0 → sernixa_cli-0.3.0}/sernixa_cli/local_agent_targets.py

@@ -17,6 +17,7 @@ ConfigFormat = Literal["json", "toml"]
 
 SERNIXA_TOML_BEGIN = "# BEGIN SERNIXA MANAGED CODEX HOOK"
 SERNIXA_TOML_END = "# END SERNIXA MANAGED CODEX HOOK"
+HOOK_TIMEOUT_SECONDS = 35
 
 
 class TargetConfigError(RuntimeError):
@@ -132,6 +133,14 @@ class TargetStatus:
             _status_path(candidate.path) for candidate in self.candidates
         ]
         primary_write_target = _status_path(self.primary_write_target)
+        enforcement_mode = (
+            "mcp_server"
+            if self.target_id in {"claude-desktop", "cursor"}
+            else "pre_tool_hook"
+        )
+        integration_effective = self.wrapper_valid and (
+            enforcement_mode == "mcp_server" or self.hooks_effective
+        )
         return {
             "target_id": self.target_id,
             "target": self.target_id,
@@ -157,6 +166,8 @@ class TargetStatus:
             "installed": self.sernixa_installed,
             "detected": self.sernixa_installed,
             "wrapper_valid": self.wrapper_valid,
+            "enforcement_mode": enforcement_mode,
+            "integration_effective": integration_effective,
             "malformed": self.malformed,
             "parse_errors": list(self.parse_errors),
             "parse_error": self.parse_errors[0] if self.parse_errors else None,
@@ -353,14 +364,14 @@ def hook_snippet(target_name: str) -> dict[str, Any]:
             "type": "command",
             "command": command[0],
             "args": command[1:],
-            "timeout": 10,
+            "timeout": HOOK_TIMEOUT_SECONDS,
             "statusMessage": "Checking Sernixa policy",
         }
     else:
         handler = {
             "type": "command",
             "command": " ".join(command),
-            "timeout": 10,
+            "timeout": HOOK_TIMEOUT_SECONDS,
             "statusMessage": "Checking Sernixa policy",
         }
     return {"hooks": {"PreToolUse": [{"matcher": "*", "hooks": [handler]}]}}
@@ -385,7 +396,7 @@ def install_target(target_name: str) -> tuple[TargetResolution, str, Path | None
             merged, changed = _merge_hooks(existing, snippet, resolution.provider)
         backup_path = _backup(path) if path.exists() and changed else None
         _write_private_text(path, json.dumps(merged, indent=2, sort_keys=True) + "\n")
-    return resolution, "installed" if changed else "updated", backup_path
+    return resolution, "installed" if changed else "already_valid", backup_path
 
 
 def target_status(target_name: str) -> TargetStatus:
@@ -440,6 +451,9 @@ def target_status(target_name: str) -> TargetStatus:
         selected_reason=resolution.selected_reason,
         uncertainty=resolution.uncertainty,
         detected_hook_sources=tuple(detected_sources),
+        hooks_declared=wrapper_valid if resolution.target_id == "claude" else False,
+        hooks_enabled=wrapper_valid if resolution.target_id == "claude" else False,
+        hooks_effective=wrapper_valid if resolution.target_id == "claude" else False,
     )
 
 
@@ -971,7 +985,7 @@ def _codex_toml_block() -> str:
         "[[hooks.PreToolUse.hooks]]\n"
         'type = "command"\n'
         'command = "sernixa hook run codex"\n'
-        "timeout = 10\n"
+        f"timeout = {HOOK_TIMEOUT_SECONDS}\n"
         'statusMessage = "Checking Sernixa policy"\n'
         f"{SERNIXA_TOML_END}\n"
     )
@@ -1074,7 +1088,24 @@ def _mcp_server_state(
 
 
 def _group_has_expected_wrapper(group: Any, provider: Provider) -> bool:
-    return _expected_command(provider) in _commands(group)
+    if not isinstance(group, dict):
+        return False
+    for hook in group.get("hooks") or []:
+        if not isinstance(hook, dict):
+            continue
+        command = hook.get("command")
+        args = hook.get("args")
+        full = (
+            " ".join([command, *[str(item) for item in args]])
+            if isinstance(command, str) and isinstance(args, list)
+            else command
+        )
+        if (
+            full == _expected_command(provider)
+            and hook.get("timeout") == HOOK_TIMEOUT_SECONDS
+        ):
+            return True
+    return False
 
 
 def _is_sernixa_group_for_provider(group: Any, provider: Provider) -> bool:
@@ -1122,7 +1153,11 @@ def _toml_find_sernixa_wrapper(value: Any, *, expect_valid: bool) -> bool:
                 if isinstance(args, list)
                 else command
             )
-            if expect_valid and full == "sernixa hook run codex":
+            if (
+                expect_valid
+                and full == "sernixa hook run codex"
+                and value.get("timeout") == HOOK_TIMEOUT_SECONDS
+            ):
                 return True
             if not expect_valid and "sernixa" in full and "codex" in full:
                 return True