claude-mpm 3.4.10__py3-none-any.whl → 5.4.55__py3-none-any.whl

claude_mpm/services/version_control/git_operations.py

@@ -1,3 +1,5 @@
+from pathlib import Path
+
 """
 Git Operations Manager - Core Git operation automation for Version Control Agent.
 
@@ -9,14 +11,17 @@ This module provides comprehensive Git operation management including:
 5. Automatic branch lifecycle management
 """
 
+import logging
 import os
 import subprocess
-import re
-from datetime import datetime
-from pathlib import Path
-from typing import Dict, List, Optional, Any, Tuple
 from dataclasses import dataclass, field
-import logging
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional
+
+# Privileged users who can push directly to main branch
+# All other users must use feature branches and PRs
+PRIVILEGED_GIT_USERS = ["bobmatnyc@users.noreply.github.com"]
+PROTECTED_BRANCHES = ["main", "master"]
 
 
 @dataclass
@@ -52,7 +57,9 @@ class GitOperationResult:
 class GitOperationError(Exception):
     """Exception raised for Git operation errors."""
 
-    def __init__(self, message: str, command: str = "", output: str = "", error: str = ""):
+    def __init__(
+        self, message: str, command: str = "", output: str = "", error: str = ""
+    ):
         super().__init__(message)
         self.command = command
         self.output = output
@@ -89,12 +96,104 @@ class GitOperationsManager:
         }
 
         # Merge strategies
-        self.merge_strategies = {"merge": "--no-ff", "squash": "--squash", "rebase": "--rebase"}
+        self.merge_strategies = {
+            "merge": "--no-ff",
+            "squash": "--squash",
+            "rebase": "--rebase",
+        }
 
         # Validate Git repository
         if not self._is_git_repository():
             raise GitOperationError(f"Not a Git repository: {project_root}")
 
+    def _get_current_git_user(self) -> str:
+        """
+        Get the current Git user email.
+
+        Returns:
+            Git user email configured in repository or globally
+
+        Raises:
+            GitOperationError: If git user.email is not configured
+        """
+        try:
+            result = self._run_git_command(["config", "user.email"])
+            email = result.stdout.strip()
+            if not email:
+                raise GitOperationError(
+                    "Git user.email is not configured. "
+                    "Please configure it with: git config user.email 'your@email.com'"
+                )
+            return email
+        except GitOperationError as e:
+            raise GitOperationError(
+                "Git user.email is not configured. "
+                "Please configure it with: git config user.email 'your@email.com'"
+            ) from e
+
+    def _is_privileged_user(self) -> bool:
+        """
+        Check if the current Git user is privileged to push to protected branches.
+
+        Returns:
+            True if user email is in PRIVILEGED_GIT_USERS, False otherwise
+        """
+        try:
+            current_user = self._get_current_git_user()
+            return current_user in PRIVILEGED_GIT_USERS
+        except GitOperationError:
+            # If we can't determine user, assume not privileged
+            return False
+
+    def _enforce_branch_protection(
+        self, target_branch: str, operation: str
+    ) -> Optional[GitOperationResult]:
+        """
+        Enforce branch protection rules for protected branches.
+
+        Args:
+            target_branch: Branch being operated on
+            operation: Operation being performed (e.g., "push", "merge")
+
+        Returns:
+            GitOperationResult with error if protection violated, None if allowed
+        """
+        # Check if target branch is protected
+        if target_branch not in PROTECTED_BRANCHES:
+            return None
+
+        # Check if user is privileged
+        if self._is_privileged_user():
+            return None
+
+        # Get current user for error message
+        try:
+            current_user = self._get_current_git_user()
+        except GitOperationError:
+            current_user = "unknown"
+
+        # Build helpful error message
+        error_message = (
+            f"Direct {operation} to '{target_branch}' branch is restricted.\n"
+            f"Only {', '.join(PRIVILEGED_GIT_USERS)} can {operation} directly to protected branches.\n"
+            f"Current user: {current_user}\n\n"
+            f"Please use the feature branch workflow:\n"
+            f"  1. git checkout -b feature/your-feature-name\n"
+            f"  2. Make your changes and commit\n"
+            f"  3. git push -u origin feature/your-feature-name\n"
+            f"  4. Create a Pull Request on GitHub for review"
+        )
+
+        return GitOperationResult(
+            success=False,
+            operation=f"{operation}_branch_protection",
+            message=f"Branch protection: {operation} to '{target_branch}' denied",
+            error=error_message,
+            branch_before=self.get_current_branch(),
+            branch_after=self.get_current_branch(),
+            execution_time=0.0,
+        )
+
     def _is_git_repository(self) -> bool:
         """Check if the directory is a Git repository."""
         return self.git_dir.exists() and self.git_dir.is_dir()
@@ -121,7 +220,7 @@ class GitOperationsManager:
         Raises:
             GitOperationError: If command fails and check=True
         """
-        cmd = ["git"] + args
+        cmd = ["git", *args]
         cwd = cwd or str(self.project_root)
 
         try:
@@ -141,10 +240,10 @@ class GitOperationsManager:
 
             return result
 
-        except FileNotFoundError:
-            raise GitOperationError("Git is not installed or not in PATH")
+        except FileNotFoundError as e:
+            raise GitOperationError("Git is not installed or not in PATH") from e
         except Exception as e:
-            raise GitOperationError(f"Error running Git command: {e}")
+            raise GitOperationError(f"Error running Git command: {e}") from e
 
     def get_current_branch(self) -> str:
         """Get the current Git branch name."""
@@ -182,7 +281,8 @@ class GitOperationsManager:
         try:
             # Get remote tracking branch
             result = self._run_git_command(
-                ["rev-parse", "--abbrev-ref", f"{branch_name}@{{upstream}}"], check=False
+                ["rev-parse", "--abbrev-ref", f"{branch_name}@{{upstream}}"],
+                check=False,
             )
 
             if result.returncode == 0:
@@ -191,7 +291,12 @@ class GitOperationsManager:
 
                 # Get ahead/behind info
                 result = self._run_git_command(
-                    ["rev-list", "--left-right", "--count", f"{upstream}...{branch_name}"],
+                    [
+                        "rev-list",
+                        "--left-right",
+                        "--count",
+                        f"{upstream}...{branch_name}",
+                    ],
                     check=False,
                 )
 
@@ -208,7 +313,9 @@ class GitOperationsManager:
         last_commit_message = None
 
         try:
-            result = self._run_git_command(["log", "-1", "--format=%H", branch_name], check=False)
+            result = self._run_git_command(
+                ["log", "-1", "--format=%H", branch_name], check=False
+            )
 
             if result.returncode == 0:
                 last_commit = result.stdout.strip()
@@ -273,7 +380,9 @@ class GitOperationsManager:
                                 name=remote_branch,
                                 current=False,
                                 remote=(
-                                    remote_branch.split("/")[0] if "/" in remote_branch else None
+                                    remote_branch.split("/")[0]
+                                    if "/" in remote_branch
+                                    else None
                                 ),
                             )
                         )
@@ -308,26 +417,26 @@ class GitOperationsManager:
     def is_file_tracked(self, file_path: str) -> bool:
         """
         Check if a file is tracked by git.
-        
+
         Args:
             file_path: Path to the file to check (can be absolute or relative)
-            
+
         Returns:
             bool: True if file is tracked, False otherwise
         """
         try:
             # Convert to relative path if absolute
-            if os.path.isabs(file_path):
+            if Path(file_path).is_absolute():
                 try:
                     file_path = os.path.relpath(file_path, self.project_root)
                 except ValueError:
                     # If file is outside project root, it's not tracked
                     return False
-            
+
             # Use git ls-files to check if file is tracked
             result = self._run_git_command(["ls-files", "--", file_path])
             return bool(result.stdout.strip())
-            
+
         except GitOperationError:
             return False
 
@@ -350,7 +459,7 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with operation details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
         # Generate full branch name with prefix
@@ -375,12 +484,14 @@ class GitOperationsManager:
             # Set up remote tracking if creating a new branch
             if switch_to_branch:
                 try:
-                    self._run_git_command(["push", "-u", "origin", full_branch_name], check=False)
+                    self._run_git_command(
+                        ["push", "-u", "origin", full_branch_name], check=False
+                    )
                 except GitOperationError:
                     # Remote push failed, continue without remote tracking
                     pass
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -393,7 +504,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,
@@ -415,7 +526,7 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with operation details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
         try:
@@ -425,18 +536,20 @@ class GitOperationsManager:
                 return GitOperationResult(
                     success=False,
                     operation="switch_branch",
-                    message=f"Cannot switch branch: uncommitted changes exist",
+                    message="Cannot switch branch: uncommitted changes exist",
                     error=f"Modified files: {', '.join(modified_files)}",
                     branch_before=current_branch,
                     branch_after=current_branch,
                     files_changed=modified_files,
-                    execution_time=(datetime.now() - start_time).total_seconds(),
+                    execution_time=(
+                        datetime.now(timezone.utc) - start_time
+                    ).total_seconds(),
                 )
 
             # Switch to the branch
             result = self._run_git_command(["checkout", branch_name])
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -449,7 +562,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,
@@ -480,9 +593,14 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with operation details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
+        # Enforce branch protection for target branch
+        protection_result = self._enforce_branch_protection(target_branch, "merge")
+        if protection_result:
+            return protection_result
+
         try:
             # Switch to target branch
             if current_branch != target_branch:
@@ -504,7 +622,9 @@ class GitOperationsManager:
                 merge_args = ["merge", strategy_arg, source_branch]
                 if merge_strategy == "merge":
                     # Add merge commit message
-                    merge_args.extend(["-m", f"Merge {source_branch} into {target_branch}"])
+                    merge_args.extend(
+                        ["-m", f"Merge {source_branch} into {target_branch}"]
+                    )
 
                 result = self._run_git_command(merge_args)
 
@@ -522,7 +642,7 @@ class GitOperationsManager:
                     # Branch deletion failed, but merge was successful
                     pass
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -535,7 +655,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,
@@ -547,7 +667,9 @@ class GitOperationsManager:
                 execution_time=execution_time,
             )
 
-    def detect_merge_conflicts(self, source_branch: str, target_branch: str) -> Dict[str, Any]:
+    def detect_merge_conflicts(
+        self, source_branch: str, target_branch: str
+    ) -> Dict[str, Any]:
         """
         Detect potential merge conflicts between branches.
 
@@ -576,15 +698,17 @@ class GitOperationsManager:
             conflicted_files = []
             if has_conflicts:
                 lines = result.stdout.split("\n")
-                current_file = None
 
                 for line in lines:
-                    if line.startswith("+++") or line.startswith("---"):
+                    if line.startswith(("+++", "---")):
                         # Extract filename
                         parts = line.split("\t")
                         if len(parts) > 1:
                             filename = parts[1].strip()
-                            if filename != "/dev/null" and filename not in conflicted_files:
+                            if (
+                                filename != "/dev/null"
+                                and filename not in conflicted_files
+                            ):
                                 conflicted_files.append(filename)
 
             return {
@@ -611,7 +735,10 @@ class GitOperationsManager:
             return None
 
     def push_to_remote(
-        self, branch_name: Optional[str] = None, remote: str = "origin", set_upstream: bool = False
+        self,
+        branch_name: Optional[str] = None,
+        remote: str = "origin",
+        set_upstream: bool = False,
     ) -> GitOperationResult:
         """
         Push branch to remote repository.
@@ -624,12 +751,17 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with operation details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
         if not branch_name:
             branch_name = current_branch
 
+        # Enforce branch protection
+        protection_result = self._enforce_branch_protection(branch_name, "push")
+        if protection_result:
+            return protection_result
+
         try:
             # Build push command
             push_args = ["push"]
@@ -641,7 +773,7 @@ class GitOperationsManager:
 
             result = self._run_git_command(push_args)
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -654,7 +786,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,
@@ -679,7 +811,7 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with operation details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
         if not branch_name:
@@ -698,7 +830,7 @@ class GitOperationsManager:
                 result = self._run_git_command(["pull", remote, branch_name])
                 self._run_git_command(["checkout", current_branch])
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -711,7 +843,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,
@@ -723,7 +855,9 @@ class GitOperationsManager:
                 execution_time=execution_time,
             )
 
-    def cleanup_merged_branches(self, target_branch: str = "main") -> GitOperationResult:
+    def cleanup_merged_branches(
+        self, target_branch: str = "main"
+    ) -> GitOperationResult:
         """
         Clean up branches that have been merged into target branch.
 
@@ -733,7 +867,7 @@ class GitOperationsManager:
         Returns:
             GitOperationResult with cleanup details
         """
-        start_time = datetime.now()
+        start_time = datetime.now(timezone.utc)
         current_branch = self.get_current_branch()
 
         try:
@@ -744,7 +878,7 @@ class GitOperationsManager:
             for line in result.stdout.strip().split("\n"):
                 branch = line.strip().lstrip("* ").strip()
                 # Skip target branch and current branch
-                if branch and branch != target_branch and branch != current_branch:
+                if branch and branch not in (target_branch, current_branch):
                     merged_branches.append(branch)
 
             # Delete merged branches
@@ -760,7 +894,7 @@ class GitOperationsManager:
             # Clean up remote tracking branches
             self._run_git_command(["remote", "prune", "origin"], check=False)
 
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=True,
@@ -773,7 +907,7 @@ class GitOperationsManager:
             )
 
         except GitOperationError as e:
-            execution_time = (datetime.now() - start_time).total_seconds()
+            execution_time = (datetime.now(timezone.utc) - start_time).total_seconds()
 
             return GitOperationResult(
                 success=False,