agentgov-cli 0.1.18__tar.gz → 0.1.19__tar.gz

{agentgov_cli-0.1.18 → agentgov_cli-0.1.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgov-cli
-Version: 0.1.18
+Version: 0.1.19
 Summary: AgentGov CLI — wrap Claude Code, bind work items, check gateway health.
 Author: AgentGov Contributors
 License: Apache-2.0

{agentgov_cli-0.1.18 → agentgov_cli-0.1.19}/agentgov_cli/client_assets/hooks/userpromptsubmit_workitem.py

@@ -817,6 +817,100 @@ def _gateway_in_request_path(session_id: str, *, gateway_url_answered: bool) ->
     return _gateway_answers_at(base, session_id)
 
 
+def _is_git_repo(path: str) -> bool:
+    """True when `path` sits inside a git work tree.
+
+    Returns True on any failure to decide. A hook that cannot run `git` must not
+    invent a permanent-failure verdict: being wrong in that direction blocks a
+    developer whose setup is fine, which is worse than the generic retry advice.
+    """
+    if not path:
+        return False
+    try:
+        r = subprocess.run(
+            ["git", "-C", path, "rev-parse", "--is-inside-work-tree"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return True
+    return r.stdout.strip() == "true"
+
+
+def _nearest_repo_below(path: str, max_depth: int = 2) -> str:
+    """A git checkout nested just inside `path`, if there is exactly one.
+
+    The case this exists for: a wrapper folder containing the real project, e.g.
+    `ManifestAlignmentApp/ManifestExpo`. Opening the editor at the wrapper leaves
+    the session with no repository at all, and the developer sees a message about
+    the gateway rather than about where they opened their editor.
+
+    Naming the actual directory turns a hunt into a click. Only an unambiguous
+    answer is offered — with two or more candidates the guess could send someone
+    to the wrong project, and a confidently wrong suggestion is worse than none.
+    """
+    try:
+        entries = sorted(
+            e for e in os.listdir(path) if not e.startswith(".") and os.path.isdir(os.path.join(path, e))
+        )
+    except OSError:
+        return ""
+    found = [e for e in entries if os.path.isdir(os.path.join(path, e, ".git"))]
+    if len(found) == 1:
+        return os.path.join(path, found[0])
+    if max_depth > 1:
+        # One level deeper, for `repos/<name>/<project>` layouts. Still only
+        # accepted when a single candidate exists anywhere at that level.
+        deeper = [
+            d
+            for e in entries
+            for d in [_nearest_repo_below(os.path.join(path, e), max_depth - 1)]
+            if d
+        ]
+        if len(deeper) == 1:
+            return deeper[0]
+    return ""
+
+
+def _not_a_repository_message(cwd: str) -> str:
+    """Say what is actually wrong, and where the repository probably is.
+
+    Replaces the transient-sounding "the gateway does not recognise this session
+    … send your prompt again" for the one case where retrying can never work.
+    """
+    nested = _nearest_repo_below(cwd)
+    lines = [
+        "\U0001f4cc AgentGov: this folder is not a git repository, so there is "
+        "nothing to authorize.",
+        "",
+        f"   Claude Code was opened at:  {cwd or 'an unknown directory'}",
+        "   A session is registered against a repository, so a folder without one",
+        "   cannot be governed — and retrying will not change that.",
+    ]
+    if nested:
+        lines += [
+            "",
+            f"   The repository appears to be one level in:  {nested}",
+            "   Open that folder in your editor instead, then send your prompt again.",
+        ]
+    else:
+        lines += [
+            "",
+            "   Open your editor at the folder that contains `.git`, or run",
+            "   `git init` here if this really is a new project.",
+        ]
+    lines += [
+        "",
+        "   Then check the repository is granted to you:",
+        "     git remote get-url origin      # this exact text must appear on the Grants page",
+        "",
+        "   Nothing was sent upstream and no tokens were used.",
+    ]
+    return "\n".join(lines)
+
+
 def _gateway_unreachable_message() -> str:
     """Why a blocked prompt was blocked, when the cause is not the work item.
 
@@ -1614,9 +1708,24 @@ def main() -> None:
         _allow_reporting(root_label, repo_display, child_label)
 
     if _needs_registration(data):
-        # The gateway does not recognise this session. This is almost always
-        # TRANSIENT, not an attack: the gateway keeps sessions in memory, so a
-        # restart or reinstall forgets every editor window that is already open.
+        # BEFORE assuming this is transient, rule out the one cause that never is.
+        #
+        # A session can only be registered against a repository, so if the editor
+        # was opened in a directory that is not a git checkout there is nothing to
+        # register and re-registering cannot succeed. The developer was
+        # nonetheless told "this is usually temporary — send your prompt again",
+        # and retried, and retried. It cost a real user ten rounds of debugging on
+        # a folder that merely had the project nested one level inside it.
+        #
+        # This is the same defect as reporting a database timeout as 401 or a
+        # Stripe misconfiguration as "try again shortly": a permanent condition
+        # dressed as a transient one, which turns a five-second fix into an hour.
+        # The check is cheap and runs only on the failure path.
+        if not _is_git_repo(cwd):
+            _block(_not_a_repository_message(cwd))
+
+        # Genuinely transient: the gateway keeps sessions in memory, so a restart
+        # forgets every editor window that is already open.
         #
         # Blocking here was a serious mistake. It bricked every open Claude Code
         # window after a gateway restart, with a message telling the developer to

{agentgov_cli-0.1.18 → agentgov_cli-0.1.19}/pyproject.toml

@@ -2,7 +2,7 @@
 # PyPI: `agentgov` was rejected as too similar to existing `agent-gov`.
 # Package name is agentgov-cli; the console command it installs is still `agentgov`.
 name = "agentgov-cli"
-version = "0.1.18"
+version = "0.1.19"
 description = "AgentGov CLI — wrap Claude Code, bind work items, check gateway health."
 readme = "README.md"
 license = { text = "Apache-2.0" }