ai-push-hooks 0.1.18 → 0.2.0

package/src/ai_push_hooks/hook.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import os
 import pathlib
 import sys
 from typing import Sequence
@@ -8,28 +9,32 @@ from typing import Sequence
 from .artifacts import ArtifactStore, generate_run_id
 from .config import load_config
 from .engine import WorkflowEngine
+from .paths import ensure_private_directory, resolve_contained_path, write_text_no_follow
 from .executors.exec import (
     collect_changed_files,
     collect_diff,
-    collect_ranges_from_stdin,
+    collect_revision_ranges,
     current_branch,
     ensure_dir,
+    env_bool,
     git,
+    parse_push_updates,
     resolve_git_dir,
     resolve_repo_root,
     resolve_storage_path,
     should_skip_for_sync_branch,
+    unique_range_expressions,
 )
-from .executors.llm import resolve_opencode_executable
 from .types import HookConfig, HookError, HookLogger, RuntimeContext
 
 
 def _build_logger(repo_root: pathlib.Path, git_dir: pathlib.Path, config: HookConfig) -> HookLogger:
+    ensure_private_directory(git_dir / "ai-push-hooks")
     jsonl_path = None
     if config.logging.jsonl:
         log_dir = ensure_dir(resolve_storage_path(repo_root, git_dir, config.logging.dir))
         if log_dir is not None:
-            jsonl_path = log_dir / "hook.jsonl"
+            jsonl_path = resolve_contained_path(log_dir, "hook.jsonl", "JSONL log path")
     return HookLogger(jsonl_path=jsonl_path, console_level=config.logging.level)
 
 
@@ -39,8 +44,12 @@ def _write_summary(context: RuntimeContext, result: dict[str, object]) -> None:
     )
     if summary_dir is None:
         return
-    summary_path = summary_dir / f"{context.run_id}.json"
-    summary_path.write_text(json.dumps(result, ensure_ascii=True, indent=2) + "\n", encoding="utf-8")
+    summary_path = resolve_contained_path(
+        summary_dir,
+        f"{context.run_id}.json",
+        "Summary output path",
+    )
+    write_text_no_follow(summary_path, json.dumps(result, ensure_ascii=True, indent=2) + "\n")
 
 
 def _assert_clean_worktree(repo_root: pathlib.Path) -> None:
@@ -49,7 +58,7 @@ def _assert_clean_worktree(repo_root: pathlib.Path) -> None:
         raise HookError("Hook requires a clean worktree but local changes are present")
 
 
-def run_hook(
+def _run_hook_impl(
     remote_name: str = "",
     remote_url: str = "",
     stdin_lines: Sequence[str] | None = None,
@@ -59,6 +68,7 @@ def run_hook(
     repo_root = resolve_repo_root(current_dir)
     git_dir = resolve_git_dir(repo_root)
     config, _config_path = load_config(repo_root)
+    ensure_private_directory(git_dir / "ai-push-hooks")
     logger = _build_logger(repo_root, git_dir, config)
 
     if not config.general.enabled:
@@ -66,28 +76,73 @@ def run_hook(
         return 0
     if config.general.require_clean_worktree:
         _assert_clean_worktree(repo_root)
+
+    actual_stdin = list(stdin_lines) if stdin_lines is not None else [line.rstrip("\n") for line in sys.stdin]
+    push_updates = parse_push_updates(actual_stdin)
+    pushed_branch_updates = [
+        update
+        for update in push_updates
+        if update.ref_kind == "branch" and update.operation != "delete"
+    ]
+    if len(pushed_branch_updates) > 1:
+        pushed_refs = ", ".join(update.remote_ref for update in pushed_branch_updates)
+        raise HookError(
+            "Ambiguous push contains multiple branch updates; refusing to skip branch gates: "
+            + pushed_refs
+        )
+    pushed_branches = list(
+        dict.fromkeys(
+            update.branch_name for update in pushed_branch_updates if update.branch_name is not None
+        )
+    )
     if config.general.skip_on_sync_branch:
-        skip_sync, reason = should_skip_for_sync_branch(repo_root)
+        skip_sync, reason = should_skip_for_sync_branch(
+            repo_root, pushed_branches, push_updates
+        )
         if skip_sync:
             logger.status("hook.skip_sync_branch", f"Skipping AI push hooks: {reason}")
             return 0
 
-    actual_stdin = list(stdin_lines) if stdin_lines is not None else [line.rstrip("\n") for line in sys.stdin]
-    ranges = collect_ranges_from_stdin(repo_root, remote_name or "origin", actual_stdin)
+    revision_ranges = collect_revision_ranges(
+        repo_root, remote_name or "origin", push_updates, config.general.base_branch
+    )
+    ranges = unique_range_expressions(revision_ranges)
     changed_files = collect_changed_files(repo_root, ranges) if ranges else []
     diff_text = collect_diff(repo_root, ranges, config.llm.max_diff_bytes) if ranges else ""
+    if len(pushed_branches) == 1:
+        branch_name = pushed_branches[0]
+        branch_selection_reason = "single pushed branch"
+        branch_revision_ranges = [
+            item for item in revision_ranges if item.update.branch_name == branch_name
+        ]
+        branch_ranges = unique_range_expressions(branch_revision_ranges)
+        if branch_ranges == ranges:
+            branch_changed_files = changed_files
+            branch_diff_text = diff_text
+        else:
+            branch_changed_files = (
+                collect_changed_files(repo_root, branch_ranges) if branch_ranges else []
+            )
+            branch_diff_text = (
+                collect_diff(repo_root, branch_ranges, config.llm.max_diff_bytes)
+                if branch_ranges
+                else ""
+            )
+        branch_is_new = any(
+            update.branch_name == branch_name and update.operation == "create"
+            for update in push_updates
+        )
+    else:
+        branch_name = ""
+        branch_selection_reason = "no pushed branch updates"
+        branch_revision_ranges = []
+        branch_ranges = []
+        branch_changed_files = []
+        branch_diff_text = ""
+        branch_is_new = False
     run_id = generate_run_id()
     run_dir = resolve_storage_path(repo_root, git_dir, f".git/ai-push-hooks/runs/{run_id}")
 
-    opencode_executable = None
-    if any(
-        step.type in {"llm", "apply"}
-        for module in config.modules.values()
-        for step in module.steps
-        if module.enabled
-    ):
-        opencode_executable = resolve_opencode_executable()
-
     context = RuntimeContext(
         repo_root=repo_root,
         git_dir=git_dir,
@@ -98,21 +153,46 @@ def run_hook(
         stdin_lines=actual_stdin,
         run_id=run_id,
         run_dir=run_dir,
-        opencode_executable=opencode_executable,
+        opencode_executable=None,
         cache={
             "ranges": ranges,
+            "revision_ranges": revision_ranges,
             "changed_files": changed_files,
             "diff_text": diff_text,
-            "branch_name": current_branch(repo_root),
-            "sync_branch": "beads-sync",
+            "push_updates": push_updates,
+            "pushed_branch_updates": pushed_branch_updates,
+            "pushed_branches": pushed_branches,
+            "branch_name": branch_name,
+            "branch_selection_reason": branch_selection_reason,
+            "branch_revision_ranges": branch_revision_ranges,
+            "branch_ranges": branch_ranges,
+            "branch_changed_files": branch_changed_files,
+            "branch_diff_text": branch_diff_text,
+            "branch_is_new": branch_is_new,
+            "checked_out_branch": current_branch(repo_root),
+            "base_branch": config.general.base_branch,
+            "sync_branch": os.getenv("BEADS_SYNC_BRANCH", "beads-sync"),
         },
     )
     logger.status(
         "hook.start",
         "Starting AI push hooks workflow",
         branch=context.cache["branch_name"],
+        checked_out_branch=context.cache["checked_out_branch"],
+        branch_selection_reason=branch_selection_reason,
         changed_files=len(changed_files),
         ranges=ranges,
+        push_updates=[
+            {
+                "local_ref": update.local_ref,
+                "local_sha": update.local_sha,
+                "remote_ref": update.remote_ref,
+                "remote_sha": update.remote_sha,
+                "ref_kind": update.ref_kind,
+                "operation": update.operation,
+            }
+            for update in push_updates
+        ],
     )
     engine = WorkflowEngine(context=context, artifacts=ArtifactStore(run_dir))
     try:
@@ -128,3 +208,33 @@ def run_hook(
             logger.warn("hook.fail_open", "Allowing push because allow_push_on_error=true", error=message)
             return 0
         raise
+
+
+def run_hook(
+    remote_name: str = "",
+    remote_url: str = "",
+    stdin_lines: Sequence[str] | None = None,
+    cwd: pathlib.Path | None = None,
+) -> int:
+    if env_bool("AI_PUSH_HOOKS_SKIP") is True:
+        return 0
+    try:
+        return _run_hook_impl(remote_name, remote_url, stdin_lines, cwd)
+    except Exception as exc:  # noqa: BLE001
+        allow_on_error = env_bool("AI_PUSH_HOOKS_ALLOW_PUSH_ON_ERROR")
+        if allow_on_error is None:
+            try:
+                repo_root = resolve_repo_root(cwd or pathlib.Path.cwd())
+                config, _ = load_config(repo_root)
+                allow_on_error = config.general.allow_push_on_error
+            except Exception:  # noqa: BLE001
+                allow_on_error = False
+        if allow_on_error:
+            message = str(exc).strip() or exc.__class__.__name__
+            sys.stderr.write(
+                "[ai-push-hooks] Allowing push because allow_push_on_error=true: "
+                + message
+                + "\n"
+            )
+            return 0
+        raise

package/src/ai_push_hooks/install.py

@@ -0,0 +1,205 @@
+from __future__ import annotations
+
+import os
+import pathlib
+import shlex
+import shutil
+import stat
+import subprocess
+import sys
+
+from .paths import atomic_write_bytes, is_path_within, path_is_link_or_reparse
+from .types import HookError
+
+_GIT_QUERY_TIMEOUT = 10.0
+_HOOK_MODE = 0o755
+
+
+def _regular_absolute_path(raw: str | None) -> str | None:
+    if not raw:
+        return None
+    candidate = pathlib.Path(raw)
+    if not candidate.is_absolute():
+        return None
+    try:
+        resolved = candidate.resolve(strict=True)
+        metadata = resolved.lstat()
+    except (OSError, RuntimeError):
+        return None
+    if not stat.S_ISREG(metadata.st_mode) or path_is_link_or_reparse(resolved):
+        return None
+    return str(resolved)
+
+
+def _delegate_argv() -> tuple[str, ...]:
+    node = _regular_absolute_path(os.environ.get("AI_PUSH_HOOKS_NODE_EXECUTABLE"))
+    node_script = _regular_absolute_path(os.environ.get("AI_PUSH_HOOKS_NODE_SCRIPT"))
+    if node and node_script:
+        return (node, node_script)
+
+    invoked_as = pathlib.Path(sys.argv[0])
+    if invoked_as.name == "ai-push-hooks":
+        executable = _regular_absolute_path(str(invoked_as))
+        if executable is None and not invoked_as.is_absolute():
+            executable = _regular_absolute_path(shutil.which(str(invoked_as)))
+        if executable:
+            return (executable,)
+    return ("ai-push-hooks",)
+
+
+def pre_push_hook_script(delegate: tuple[str, ...] | None = None) -> str:
+    """Return the small, argument/stdin/exit-status preserving hook delegate."""
+    delegate = delegate or ("ai-push-hooks",)
+    command = " ".join(shlex.quote(part) for part in delegate)
+    if delegate == ("ai-push-hooks",):
+        availability_check = (
+            "if ! command -v ai-push-hooks >/dev/null 2>&1; then\n"
+            "  echo '[ai-push-hooks] ai-push-hooks is not on PATH for the Git hook process.' >&2\n"
+            "  echo '[ai-push-hooks] Add the Python/npm installation bin directory to PATH.' >&2\n"
+            "  exit 127\n"
+            "fi\n"
+        )
+    else:
+        availability_check = ""
+    return (
+        "#!/bin/sh\n"
+        + availability_check
+        + f'exec {command} hook "$@"\n'
+    )
+
+
+def _git_value(cwd: pathlib.Path, *args: str) -> str:
+    try:
+        completed = subprocess.run(
+            ["git", *args],
+            cwd=cwd,
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=_GIT_QUERY_TIMEOUT,
+        )
+    except FileNotFoundError as exc:
+        raise HookError("Git is required for `ai-push-hooks install`") from exc
+    except subprocess.TimeoutExpired as exc:
+        raise HookError(f"Git command timed out while resolving hook location: {' '.join(args)}") from exc
+    except subprocess.CalledProcessError as exc:
+        detail = (exc.stderr or exc.stdout or "not a Git repository").strip()
+        raise HookError(f"Could not resolve Git hook location: {detail}") from exc
+    return completed.stdout.strip()
+
+
+def _resolve_git_namespace(repo_root: pathlib.Path, value: str) -> pathlib.Path:
+    path = pathlib.Path(value)
+    return (repo_root / path).resolve() if not path.is_absolute() else path.resolve()
+
+
+def _path_is_in_namespace(path: pathlib.Path, namespaces: tuple[pathlib.Path, ...]) -> bool:
+    return any(is_path_within(path, namespace) for namespace in namespaces)
+
+
+def _validate_parent_chain(path: pathlib.Path, namespaces: tuple[pathlib.Path, ...]) -> None:
+    """Reject symlink/reparse parents and create only missing safe directories."""
+    parent = path.parent
+    existing: list[pathlib.Path] = []
+    current = parent
+    while not current.exists():
+        existing.append(current)
+        current = current.parent
+    if path_is_link_or_reparse(current) or not current.is_dir():
+        raise HookError(f"Refusing unsafe hook parent: {parent}")
+
+    for directory in reversed(existing):
+        if not _path_is_in_namespace(directory.resolve(strict=False), namespaces):
+            raise HookError(f"Refusing hook parent outside the repository: {directory}")
+        try:
+            directory.mkdir(mode=0o755)
+        except FileExistsError:
+            pass
+        if path_is_link_or_reparse(directory) or not directory.is_dir():
+            raise HookError(f"Refusing unsafe hook parent: {directory}")
+
+    current = parent
+    while True:
+        if path_is_link_or_reparse(current) or not current.is_dir():
+            raise HookError(f"Refusing unsafe hook parent: {current}")
+        if _path_is_in_namespace(current.resolve(strict=False), namespaces):
+            break
+        if current.parent == current:
+            raise HookError(f"Refusing hook parent outside the repository: {parent}")
+        current = current.parent
+
+
+def _effective_hook_path(current_dir: pathlib.Path) -> tuple[pathlib.Path, pathlib.Path, pathlib.Path, pathlib.Path]:
+    repo_root = pathlib.Path(_git_value(current_dir, "rev-parse", "--show-toplevel")).resolve()
+    git_dir = _resolve_git_namespace(repo_root, _git_value(repo_root, "rev-parse", "--git-dir"))
+    common_dir = _resolve_git_namespace(
+        repo_root, _git_value(repo_root, "rev-parse", "--git-common-dir")
+    )
+    raw_hooks_dir = pathlib.Path(_git_value(current_dir, "rev-parse", "--git-path", "hooks"))
+    lexical_hooks_dir = (
+        raw_hooks_dir if raw_hooks_dir.is_absolute() else current_dir / raw_hooks_dir
+    )
+    if path_is_link_or_reparse(current_dir) or not current_dir.is_dir():
+        raise HookError(f"Refusing to install from an unsafe working directory: {current_dir}")
+    if any(path_is_link_or_reparse(part) for part in lexical_hooks_dir.parents):
+        raise HookError(f"Refusing hook path with a symlink or reparse parent: {lexical_hooks_dir}")
+    if path_is_link_or_reparse(lexical_hooks_dir):
+        raise HookError(f"Refusing hook path with a symlink or reparse parent: {lexical_hooks_dir}")
+    lexical_hook_path = lexical_hooks_dir / "pre-push"
+    if path_is_link_or_reparse(lexical_hook_path):
+        raise HookError(f"Refusing symlink or reparse-point hook target: {lexical_hook_path}")
+    hook_path = lexical_hook_path.resolve(strict=False)
+
+    namespaces = (repo_root, git_dir)
+    if not _path_is_in_namespace(hook_path, namespaces):
+        raise HookError(
+            "Refusing external or shared hooks path; configure a repository-local "
+            "core.hooksPath instead"
+        )
+    if common_dir != git_dir and is_path_within(hook_path, common_dir):
+        raise HookError("Refusing shared hooks path used by linked worktrees")
+    return repo_root, git_dir, common_dir, hook_path
+
+
+def resolve_pre_push_hook_path(cwd: pathlib.Path) -> pathlib.Path:
+    """Resolve Git's effective pre-push path without changing Git configuration."""
+    return _effective_hook_path(cwd.resolve())[3]
+
+
+def install_hook(force: bool, cwd: pathlib.Path | None = None) -> int:
+    current_dir = (cwd or pathlib.Path.cwd()).resolve()
+    _repo_root, git_dir, common_dir, hook_path = _effective_hook_path(current_dir)
+    if common_dir != git_dir and is_path_within(hook_path, common_dir):
+        raise HookError("Refusing shared hooks path used by linked worktrees")
+
+    namespaces = (_repo_root, git_dir)
+    _validate_parent_chain(hook_path, namespaces)
+    try:
+        metadata = hook_path.lstat()
+    except FileNotFoundError:
+        metadata = None
+    except OSError as exc:
+        raise HookError(f"Could not inspect pre-push hook path {hook_path}: {exc}") from exc
+
+    if metadata is not None:
+        if path_is_link_or_reparse(hook_path):
+            raise HookError(f"Refusing symlink or reparse-point hook target: {hook_path}")
+        if not stat.S_ISREG(metadata.st_mode):
+            raise HookError(f"Refusing non-regular hook target: {hook_path}")
+        if not force:
+            raise HookError(
+                f"Refusing to overwrite existing pre-push hook without --force: {hook_path}"
+            )
+
+    try:
+        atomic_write_bytes(
+            hook_path,
+            pre_push_hook_script(_delegate_argv()).encode("utf-8"),
+            mode=_HOOK_MODE,
+        )
+    except HookError:
+        raise
+    except OSError as exc:
+        raise HookError(f"Could not install pre-push hook {hook_path}: {exc}") from exc
+    sys.stdout.write(str(hook_path) + "\n")
+    return 0

package/src/ai_push_hooks/modules/beads.py

@@ -2,23 +2,38 @@ from __future__ import annotations
 
 from typing import Any
 
-from ..executors.exec import collect_commit_messages_for_ranges, current_branch, is_feature_branch
+from ..executors.exec import collect_commit_messages_for_ranges, is_feature_branch
 from ..types import CollectorResult, RuntimeContext
 
 
 def collect_beads_status_context(context: RuntimeContext, state: Any) -> CollectorResult:
-    branch_name = current_branch(context.repo_root)
+    branch_name = str(context.cache.get("branch_name", ""))
+    branch_selection_reason = str(
+        context.cache.get("branch_selection_reason", "no pushed branch updates")
+    )
+    if not branch_name:
+        return CollectorResult(
+            artifacts={
+                "branch-context.txt": (
+                    f"branch=\nbranch_selection_reason={branch_selection_reason}\n"
+                )
+            },
+            skip_module=True,
+            skip_reason=branch_selection_reason,
+        )
     sync_branch = context.cache.get("sync_branch", "beads-sync")
-    if not branch_name or branch_name in {"HEAD", "main", sync_branch} or not is_feature_branch(branch_name):
+    if branch_name in {"HEAD", "main", sync_branch} or not is_feature_branch(branch_name):
         return CollectorResult(
             artifacts={"branch-context.txt": f"branch={branch_name}\n"},
             skip_module=True,
             skip_reason="branch does not require beads alignment",
         )
 
-    ranges = context.cache.get("ranges", [])
-    changed_files = context.cache.get("changed_files", [])
-    diff_text = context.cache.get("diff_text", "")
+    ranges = context.cache.get("branch_ranges", context.cache.get("ranges", []))
+    changed_files = context.cache.get(
+        "branch_changed_files", context.cache.get("changed_files", [])
+    )
+    diff_text = context.cache.get("branch_diff_text", context.cache.get("diff_text", ""))
     commits = collect_commit_messages_for_ranges(context.repo_root, ranges) if ranges else []
     report_file = "BEADS_STATUS_ACTION_REQUIRED.md"
     commit_lines = []