ai-push-hooks 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/CHANGELOG.md +68 -2
  2. package/README.md +582 -85
  3. package/SECURITY.md +96 -13
  4. package/ai-push-hooks.toml +9 -2
  5. package/package.json +1 -1
  6. package/pyproject.toml +1 -1
  7. package/src/ai_push_hooks/artifacts.py +67 -0
  8. package/src/ai_push_hooks/config.py +560 -21
  9. package/src/ai_push_hooks/engine.py +114 -6
  10. package/src/ai_push_hooks/executors/apply.py +73 -34
  11. package/src/ai_push_hooks/executors/{llm.py → ask.py} +197 -75
  12. package/src/ai_push_hooks/executors/exec.py +9 -1
  13. package/src/ai_push_hooks/executors/runner_workflow.py +478 -0
  14. package/src/ai_push_hooks/executors/runners/__init__.py +78 -0
  15. package/src/ai_push_hooks/executors/runners/claude.py +286 -0
  16. package/src/ai_push_hooks/executors/runners/codex.py +254 -0
  17. package/src/ai_push_hooks/executors/runners/command.py +178 -0
  18. package/src/ai_push_hooks/executors/runners/contracts.py +597 -0
  19. package/src/ai_push_hooks/executors/runners/opencode.py +499 -0
  20. package/src/ai_push_hooks/executors/runners/process.py +403 -0
  21. package/src/ai_push_hooks/executors/runners/registry.py +104 -0
  22. package/src/ai_push_hooks/executors/step_commands.py +473 -0
  23. package/src/ai_push_hooks/plugin_loader.py +398 -0
  24. package/src/ai_push_hooks/plugins.py +134 -0
  25. package/src/ai_push_hooks/prompts_builtin.py +9 -2
  26. package/src/ai_push_hooks/types.py +406 -75
package/CHANGELOG.md CHANGED
@@ -4,7 +4,71 @@ All notable changes to this project are documented here. The format is based on
4
4
 
5
5
  ## [Unreleased]
6
6
 
7
- No changes yet.
7
+ No unreleased changes.
8
+
9
+ ## [0.3.0] - 2026-09-09
10
+
11
+ This is a beta feature release. Python and npm both use `0.3.0`, the canonical
12
+ Git tag is `v0.3.0`, npm uses the `beta` dist-tag, and GitHub marks the release
13
+ as a prerelease. PyPI does not provide a separate beta channel, so Python users
14
+ must select the exact `0.3.0` version.
15
+
16
+ ### Added
17
+
18
+ - Added strict named runner profiles for OpenCode, Codex, Claude, and direct
19
+ shell-free command adapters, with global and per-`ask`/`apply` selection.
20
+ - Added explicit project-aware analysis and broad, bounded project apply staging
21
+ while retaining allowlisted propagation and the artifact-only OpenCode default.
22
+ - Added repository-local Python callbacks for `collect`, `exec`, and `assert`,
23
+ plus direct argv commands for `exec` and `assert`.
24
+
25
+ ### Changed
26
+
27
+ - Made model/schema retries runner-neutral and session-optional, with fresh
28
+ invocation fallback when reuse is unavailable; added truthful session,
29
+ transcript, colored status, JSONL, and normalized redacted-output reporting.
30
+ - Documented authentication ownership, provider data exposure, custom-command
31
+ and Pi trust/concurrency, protected and ignored apply inputs, and the
32
+ no-sandbox boundary.
33
+ - Renamed the workflow step spelling from `llm` to `ask` without an `llm` or
34
+ `agent` alias. The shared `[llm]` model policy keeps its historical name.
35
+
36
+ ### Fixed
37
+
38
+ - Fixed bounded child-process capture and timeout cleanup for descendant process
39
+ trees on POSIX where possible, while preventing pipe descriptors from being
40
+ reused and closed by a later invocation.
41
+
42
+ ### Compatibility and deferred work
43
+
44
+ - Published `0.2.1` remains the historical beta baseline and used `llm` as the
45
+ model-backed workflow-step spelling. Upgrading to `0.3.0` requires changing
46
+ that step spelling to `ask`; the old spelling is not accepted.
47
+ - [Deferred/proposed] Automatic discovery, an SDK, installed-module hooks,
48
+ sandboxing, and a universal external-agent observer remain out of scope.
49
+
50
+ ## [0.2.1] - 2026-09-08
51
+
52
+ This is a beta patch release. Python and npm both use `0.2.1`, the canonical
53
+ Git tag is `v0.2.1`, npm uses the `beta` dist-tag, and GitHub marks the release
54
+ as a prerelease.
55
+
56
+ ### Fixed
57
+
58
+ - Restored OpenCode's built-in plugins, including built-in authentication such as
59
+ Codex OAuth, during isolated runs. `--pure` still excludes external plugins,
60
+ and project/global configuration and plugins remain isolated.
61
+ - Restored forwarding of recognized provider environment variables, including
62
+ `OPENAI_API_KEY`, so OpenCode itself selects the authentication path.
63
+ - Prevented hook-launched Beads alignment updates from inheriting schema and
64
+ remote-migration safety overrides.
65
+ - Made post-publication PyPI verification tolerate bounded 404/partial metadata
66
+ propagation while retaining fail-closed artifact hash and authentication checks.
67
+
68
+ ### Documentation
69
+
70
+ - Documented the native `bd` maintenance, backup, rehearsal, and remote
71
+ publication boundaries; Beads-Rust (`br`) is not supported.
8
72
 
9
73
  ## [0.2.0] - 2026-09-06
10
74
 
@@ -58,6 +122,8 @@ the exact `0.2.0` version rather than a PyPI beta channel.
58
122
  - Preserved Git porcelain paths and protected pre-existing dirty allowlisted files during apply steps.
59
123
  - Clarified module-local artifact references and standardized the repository hook integration.
60
124
 
61
- [Unreleased]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.2.0...HEAD
125
+ [Unreleased]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.3.0...HEAD
126
+ [0.3.0]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.2.1...v0.3.0
127
+ [0.2.1]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.2.0...v0.2.1
62
128
  [0.2.0]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.1.19...v0.2.0
63
129
  [0.1.19]: https://github.com/shanebishop1/ai-push-hooks/compare/v0.1.18...v0.1.19