agentgov-cli 0.1.3__tar.gz → 0.1.4__tar.gz

{agentgov_cli-0.1.3 → agentgov_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentgov-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: AgentGov CLI — wrap Claude Code, bind work items, check gateway health.
 Author: AgentGov Contributors
 License: Apache-2.0

{agentgov_cli-0.1.3 → agentgov_cli-0.1.4}/agentgov_cli/commands/gateway.py

@@ -39,12 +39,17 @@ def install(gateway_url: str = _GATEWAY_OPT) -> None:
         return
 
     console.print(f"[green]{detail}[/]")
-    if gp.is_healthy(url, timeout_sec=10.0):
+    # Wait for boot rather than probing once. The service manager returns as
+    # soon as it has spawned the process, but the gateway only binds its port
+    # after rehydrating sessions and fetching the first policy snapshot — two
+    # round-trips to the control tower. A single probe here reports a false
+    # failure on a gateway that is simply still starting.
+    console.print(f"Waiting for {url}/health ...")
+    if gp.wait_until_healthy(url):
         console.print(f"[green]Gateway healthy[/] at {url}")
     else:
-        # The service manager accepted the unit but the process is not
-        # answering — surface the log rather than claiming success.
-        console.print(f"[yellow]Service installed but {url}/health did not answer yet.[/]")
+        # Genuinely not answering — surface the log rather than claiming success.
+        console.print(f"[yellow]Service installed but {url}/health did not answer in time.[/]")
         console.print(gp.log_tail())
         raise typer.Exit(1)
 

{agentgov_cli-0.1.3 → agentgov_cli-0.1.4}/agentgov_cli/commands/install.py

@@ -37,13 +37,25 @@ def run(
         help="URL of the local AgentGov gateway (usually http://localhost:8000).",
     ),
     force: bool = typer.Option(False, "--force", help="Overwrite existing hooks/statusline."),
+    user_settings: bool = typer.Option(
+        True,
+        "--user-settings/--no-user-settings",
+        help=(
+            "Register the hooks + statusline in ~/.claude/settings.json so they take "
+            "effect immediately, with no sudo. Disable for admin-managed installs."
+        ),
+    ),
 ) -> None:
     """Install hooks + statusline + slash commands into ~/.claude/.
 
+    By default this also REGISTERS them in ~/.claude/settings.json, so the
+    governance hooks run in every Claude Code session on this machine — the VS
+    Code / Cursor extension included — without sudo and without launching
+    anything through a wrapper.
+
     Also writes a ready-to-copy managed-settings.json to
-    ~/.agentgov/managed-settings.json — save that file at the OS-managed path
-    (needs sudo/admin) to force ALL Claude Code processes on this machine —
-    terminal AND VS Code extension — through the gateway.
+    ~/.agentgov/managed-settings.json. Installing THAT (needs sudo/admin) is
+    what makes governance non-overridable, for team/enterprise deployments.
     """
     src = _find_assets()
     dest = Path.home() / ".claude"
@@ -77,6 +89,16 @@ def run(
     settings = _build_managed_settings(gateway_url, hooks_dest, statusline_dest)
     settings_json = json.dumps(settings, indent=2)
 
+    # Activate the hooks for THIS user, right now, without sudo.
+    #
+    # Copying the files is not enough — Claude Code only runs hooks that a
+    # settings file registers. Previously the only place that happened was
+    # managed-settings.json, which needs root, so a developer who followed setup
+    # to the letter ended up with hook files on disk and nothing running them:
+    # no statusline, no path guard, and no work-item prompt.
+    if user_settings:
+        _merge_user_settings(gateway_url, hooks_dest, statusline_dest)
+
     # Write to a stable local path so the admin can `sudo cp` it into place
     # without having to redirect stdout carefully.
     local_settings_path = Path.home() / ".agentgov" / "managed-settings.json"
@@ -105,6 +127,95 @@ def run(
     console.print(settings_json)
 
 
+def _agentgov_hook_entries(hooks_dest: Path) -> dict[str, list[dict[str, object]]]:
+    """The hook registrations AgentGov owns, keyed by Claude Code event name."""
+    def cmd(script: str) -> dict[str, object]:
+        return {"type": "command", "command": str(hooks_dest / script)}
+
+    return {
+        "SessionStart": [{"hooks": [cmd("sessionstart_register.py")]}],
+        "UserPromptSubmit": [{"hooks": [cmd("userpromptsubmit_workitem.py")]}],
+        "PreToolUse": [
+            {
+                "matcher": "Read|Write|Edit|Glob|Grep|Bash|NotebookEdit",
+                "hooks": [cmd("pretooluse_pathguard.py")],
+            }
+        ],
+    }
+
+
+def _is_agentgov_entry(entry: object) -> bool:
+    """True if a hook registration belongs to AgentGov.
+
+    Matched on the command path so re-running `install` replaces our own entries
+    instead of stacking duplicates, while leaving the user's other hooks alone.
+    """
+    if not isinstance(entry, dict):
+        return False
+    for h in entry.get("hooks") or []:
+        if isinstance(h, dict) and "agentgov-hooks" in str(h.get("command", "")):
+            return True
+    return False
+
+
+def _merge_user_settings(gateway_url: str, hooks_dest: Path, statusline_dest: Path) -> None:
+    """Register AgentGov's hooks + statusline in ~/.claude/settings.json.
+
+    MERGES. The file usually already holds the developer's own preferences and
+    hooks; clobbering it would be a hostile way to install a governance tool.
+    We replace only entries we previously wrote (identified by their path) and
+    leave everything else untouched. A corrupt file is left alone entirely —
+    reporting it beats silently overwriting whatever was in there.
+    """
+    path = Path.home() / ".claude" / "settings.json"
+    path.parent.mkdir(parents=True, exist_ok=True)
+
+    data: dict[str, object] = {}
+    if path.exists():
+        try:
+            loaded = json.loads(path.read_text() or "{}")
+            if isinstance(loaded, dict):
+                data = loaded
+            else:
+                console.print(f"[yellow]Skipping[/] {path} — not a JSON object.")
+                return
+        except json.JSONDecodeError as e:
+            console.print(
+                f"[red]Skipping[/] {path} — it is not valid JSON ({e}).\n"
+                "Fix or remove it, then re-run `agentgov install`."
+            )
+            return
+        # Back the file up once before the first modification.
+        backup = path.with_suffix(".json.agentgov-backup")
+        if not backup.exists():
+            backup.write_text(path.read_text())
+
+    hooks_raw = data.get("hooks")
+    hooks: dict[str, object] = hooks_raw if isinstance(hooks_raw, dict) else {}
+    for event, entries in _agentgov_hook_entries(hooks_dest).items():
+        existing_raw = hooks.get(event)
+        existing = existing_raw if isinstance(existing_raw, list) else []
+        kept = [e for e in existing if not _is_agentgov_entry(e)]
+        hooks[event] = kept + entries
+    data["hooks"] = hooks
+
+    data["statusLine"] = {
+        "type": "command",
+        "command": str(statusline_dest / "agentgov_statusline.sh"),
+    }
+
+    # NOTE: deliberately NOT setting env.ANTHROPIC_BASE_URL here. User settings
+    # are the lowest-precedence scope and the developer can edit them, so
+    # pinning the base URL here would look like enforcement while being trivial
+    # to undo. Routing is the job of managed-settings.json (highest precedence).
+    path.write_text(json.dumps(data, indent=2) + "\n")
+    console.print(f"[green]Registered[/] hooks + statusline → {path}")
+    console.print(
+        "  [dim]These run in every Claude Code session on this machine, including the "
+        "VS Code extension. Restart Claude Code to pick them up.[/]"
+    )
+
+
 def _find_assets() -> Path:
     for root in ASSET_ROOTS:
         if root.exists():
@@ -122,23 +233,7 @@ def _build_managed_settings(
         },
         # apiKeyHelper disabled — Claude Code must use the agk_ key from the wrapper env.
         "apiKeyHelper": "",
-        "hooks": {
-            "PreToolUse": [
-                {
-                    "matcher": "Read|Write|Edit|Glob|Grep|Bash|NotebookEdit",
-                    "hooks": [
-                        {"type": "command", "command": str(hooks_dest / "pretooluse_pathguard.py")}
-                    ],
-                }
-            ],
-            "SessionStart": [
-                {
-                    "hooks": [
-                        {"type": "command", "command": str(hooks_dest / "sessionstart_register.py")}
-                    ]
-                }
-            ],
-        },
+        "hooks": _agentgov_hook_entries(hooks_dest),
         "statusLine": {
             "type": "command",
             "command": str(statusline_dest / "agentgov_statusline.sh"),

{agentgov_cli-0.1.3 → agentgov_cli-0.1.4}/agentgov_cli/gateway_process.py

@@ -42,7 +42,12 @@ _POLL_INTERVAL_SEC = 0.25
 
 
 def is_healthy(gateway_url: str, timeout_sec: float = 2.0) -> bool:
-    """True if a gateway answers /health at `gateway_url`."""
+    """True if a gateway answers /health at `gateway_url` RIGHT NOW.
+
+    Single probe, no retry. `timeout_sec` bounds a slow *response*; it does
+    NOT wait for a port to appear — a closed port refuses the connection
+    immediately. To wait for a booting gateway, use `wait_until_healthy`.
+    """
     try:
         r = httpx.get(f"{gateway_url.rstrip('/')}/health", timeout=timeout_sec)
     except httpx.HTTPError:
@@ -50,6 +55,28 @@ def is_healthy(gateway_url: str, timeout_sec: float = 2.0) -> bool:
     return r.status_code == 200
 
 
+def wait_until_healthy(gateway_url: str, timeout_sec: float | None = None) -> bool:
+    """Poll /health until it answers or `timeout_sec` elapses.
+
+    Startup is not instant: the gateway's lifespan awaits session rehydration
+    and the first policy-snapshot fetch, both round-trips to the control tower,
+    before uvicorn binds. Probing once right after launching it reports a false
+    "NOT RUNNING" on a gateway that is merely still booting.
+
+    `timeout_sec=None` resolves `_BOOT_TIMEOUT_SEC` at CALL time, not at import
+    time — a default argument would freeze the module constant into the
+    signature and ignore any later override.
+    """
+    if timeout_sec is None:
+        timeout_sec = _BOOT_TIMEOUT_SEC
+    deadline = time.time() + timeout_sec
+    while time.time() < deadline:
+        if is_healthy(gateway_url, timeout_sec=1.0):
+            return True
+        time.sleep(_POLL_INTERVAL_SEC)
+    return False
+
+
 def find_executable() -> str | None:
     """Locate the `agentgov-gateway` entry point.
 
@@ -109,11 +136,8 @@ def start_detached(gateway_url: str) -> tuple[bool, str]:
     finally:
         log_fh.close()
 
-    deadline = time.time() + _BOOT_TIMEOUT_SEC
-    while time.time() < deadline:
-        if is_healthy(gateway_url, timeout_sec=1.0):
-            return True, f"started; logging to {GATEWAY_LOG}"
-        time.sleep(_POLL_INTERVAL_SEC)
+    if wait_until_healthy(gateway_url):
+        return True, f"started; logging to {GATEWAY_LOG}"
 
     return False, (
         f"started but did not answer /health within {int(_BOOT_TIMEOUT_SEC)}s.\n"
@@ -141,6 +165,8 @@ def log_tail(lines: int = 15) -> str:
     except OSError as e:
         return f"(could not read {GATEWAY_LOG}: {e})"
     tail = content[-lines:]
+    if not tail:
+        return f"({GATEWAY_LOG} is empty — the gateway has not logged anything yet)"
     body = "\n".join(f"  {ln}" for ln in tail)
     return f"Last {len(tail)} line(s) of {GATEWAY_LOG}:\n{body}"
 

{agentgov_cli-0.1.3 → agentgov_cli-0.1.4}/pyproject.toml

@@ -2,7 +2,7 @@
 # PyPI: `agentgov` was rejected as too similar to existing `agent-gov`.
 # Package name is agentgov-cli; the console command it installs is still `agentgov`.
 name = "agentgov-cli"
-version = "0.1.3"
+version = "0.1.4"
 description = "AgentGov CLI — wrap Claude Code, bind work items, check gateway health."
 readme = "README.md"
 license = { text = "Apache-2.0" }