codevoight 0.1.0__py3-none-any.whl

codevoight/__init__.py

@@ -0,0 +1,8 @@
+"""CodeVoight - Voight-Kampff Human Comprehension Gate for AI Commits."""
+
+from codevoight.core.config import load_dotenv
+
+__version__ = "0.1.0"
+
+# Auto-load .env if present in workspace root
+load_dotenv()

codevoight/cli.py

@@ -0,0 +1,219 @@
+from __future__ import annotations
+
+import sys
+import time
+from pathlib import Path
+from typing import Optional
+
+import click
+
+from codevoight.core.diff import compute_diff_hash, normalize_text
+from codevoight.core.models import (
+    QuizSubmission,
+    SessionStatus,
+    StagedSession,
+)
+from codevoight.core.security import get_or_create_secret, sign_token
+from codevoight.db.repository import StateRepository
+from codevoight.generators.deterministic import (
+    DeterministicQuizEvaluator,
+    DeterministicQuizGenerator,
+)
+from codevoight.git.hook import install_pre_commit_hook, verify_staged_commit
+from codevoight.git.runner import GitRunner
+
+
+def get_repo_and_db_paths() -> tuple[Path, Path]:
+    runner = GitRunner()
+    root = (runner.get_repo_root() or Path.cwd()).resolve()
+    codevoight_dir = root / ".codevoight"
+    if not codevoight_dir.exists():
+        if (root / ".quizgate").exists():
+            codevoight_dir = root / ".quizgate"
+        elif (root / ".codegate").exists():
+            codevoight_dir = root / ".codegate"
+    db_path = codevoight_dir / "state.db"
+    return codevoight_dir, db_path
+
+
+@click.group()
+def main() -> None:
+    """CodeVoight: Voight-Kampff Comprehension Gate for AI Commits."""
+    pass
+
+
+@main.command("quiz")
+@click.argument("session_id", required=False)
+def run_quiz(session_id: Optional[str] = None) -> None:
+    """Take comprehension quiz for a staged change to unlock git commit."""
+    codevoight_dir, db_path = get_repo_and_db_paths()
+    repo = StateRepository(db_path)
+
+    session = None
+    if session_id:
+        session = repo.get_session(session_id)
+        if not session:
+            click.echo(f"[ERROR] Session '{session_id}' not found.", err=True)
+            sys.exit(1)
+    else:
+        session = repo.get_latest_pending_session()
+        if not session:
+            click.echo("[INFO] No pending quiz sessions found.", err=True)
+            click.echo("Stage code changes via MCP or 'codevoight stage' first.")
+            sys.exit(0)
+
+    click.echo("=" * 60)
+    click.echo(f"CODEVOIGHT COMPREHENSION QUIZ")
+    click.echo(f"Session ID : {session.session_id}")
+    click.echo(f"Diff Hash  : {session.diff_hash[:16]}...")
+    if session.description:
+        click.echo(f"Description: {session.description}")
+    click.echo("=" * 60)
+
+    # Show Diff Summary
+    click.echo("\n--- STAGED DIFF PREVIEW ---")
+    diff_lines = session.diff_text.strip().splitlines()
+    for line in diff_lines[:30]:
+        click.echo(line)
+    if len(diff_lines) > 30:
+        click.echo(f"... ({len(diff_lines) - 30} more lines omitted) ...")
+    click.echo("---------------------------\n")
+
+    questions = repo.get_questions_for_session(session.session_id)
+    if not questions:
+        click.echo("[WARNING] No questions found for this session. Generating on the fly...")
+        gen = DeterministicQuizGenerator()
+        questions = gen.generate_quiz(session.diff_text, session.description)
+
+    answers = {}
+    for idx, q in enumerate(questions, 1):
+        click.echo(f"\n[Question {idx}/{len(questions)}] {q.prompt}")
+        for opt in q.options:
+            click.echo(f"  [{opt.id}] {opt.text}")
+
+        valid_ids = [opt.id.upper() for opt in q.options]
+        chosen = ""
+        while chosen not in valid_ids:
+            chosen = click.prompt("Your answer", type=str).strip().upper()
+        answers[q.id] = chosen
+
+    # Evaluate
+    submission = QuizSubmission(session_id=session.session_id, answers=answers)
+    evaluator = DeterministicQuizEvaluator(passing_score=1.0)
+    result = evaluator.evaluate(submission, questions)
+
+    click.echo("\n" + "=" * 60)
+    if result.passed:
+        secret_key = get_or_create_secret(codevoight_dir)
+        token = sign_token(session.session_id, session.diff_hash, secret_key)
+        repo.update_session_status(session.session_id, SessionStatus.APPROVED, token.serialize())
+
+        click.echo(f"[PASSED] Score: {int(result.score * 100)}% ({result.correct}/{result.total})")
+        click.echo(f"[UNLOCKED] Capability token generated for diff hash {session.diff_hash[:16]}.")
+        click.echo("You may now proceed with 'git commit' or call the MCP commit tool.")
+    else:
+        repo.update_session_status(session.session_id, SessionStatus.REJECTED)
+        click.echo(f"[FAILED] Score: {int(result.score * 100)}% ({result.correct}/{result.total})")
+        click.echo("[LOCKED] Commit permission DENIED. Review the following feedback:")
+        for fb in result.feedback:
+            click.echo(f"  * {fb}")
+        click.echo("\nReview the diff and run 'codevoight quiz' to try again.")
+        sys.exit(1)
+    click.echo("=" * 60)
+
+
+@main.command("status")
+def show_status() -> None:
+    """View active and recent CodeVoight staging sessions."""
+    _, db_path = get_repo_and_db_paths()
+    if not db_path.exists():
+        click.echo("[INFO] No CodeVoight database found in current repository.")
+        return
+
+    repo = StateRepository(db_path)
+    sessions = repo.list_sessions(limit=10)
+    if not sessions:
+        click.echo("[INFO] No staging sessions found.")
+        return
+
+    click.echo(f"{'SESSION ID':<12} {'STATUS':<15} {'EXPIRES IN':<12} {'DIFF HASH':<16} {'DESCRIPTION'}")
+    click.echo("-" * 75)
+    now = time.time()
+    for s in sessions:
+        remaining = max(0, int(s.expires_at - now))
+        rem_str = f"{remaining}s" if remaining > 0 else "EXPIRED"
+        click.echo(f"{s.session_id[:10]:<12} {s.status.value:<15} {rem_str:<12} {s.diff_hash[:14]:<16} {s.description[:20]}")
+
+
+@main.command("hook")
+@click.argument("action", type=click.Choice(["install", "verify"]))
+def manage_hook(action: str) -> None:
+    """Install or test the Git pre-commit verification hook."""
+    if action == "install":
+        success, msg = install_pre_commit_hook()
+        if success:
+            click.echo(f"[SUCCESS] CodeVoight pre-commit hook installed to: {msg}")
+        else:
+            click.echo(f"[ERROR] Failed to install hook: {msg}", err=True)
+            sys.exit(1)
+    elif action == "verify":
+        success, msg = verify_staged_commit()
+        if success:
+            click.echo(f"[SUCCESS] {msg}")
+        else:
+            click.echo(f"[DENIED] {msg}", err=True)
+            sys.exit(1)
+
+
+@main.command("verify-commit", hidden=True)
+def run_verify_commit() -> None:
+    """Internal entrypoint invoked directly by .git/hooks/pre-commit."""
+    success, msg = verify_staged_commit()
+    if not success:
+        click.echo(f"[CODEVOIGHT] {msg}", err=True)
+        sys.exit(1)
+    sys.exit(0)
+
+
+@main.command("stage")
+@click.argument("files", nargs=-1, required=True)
+@click.option("--description", "-m", default="Manual CLI staging", help="Description of staged change")
+def stage_from_cli(files: tuple[str, ...], description: str) -> None:
+    """Stage files and create a comprehension quiz session."""
+    runner = GitRunner()
+    if not runner.is_git_repo():
+        click.echo("[ERROR] Not in a git repository.", err=True)
+        sys.exit(1)
+
+    runner.stage_files(list(files))
+    staged_diff = runner.get_staged_diff()
+    if not staged_diff.strip():
+        click.echo("[WARNING] No staged changes found for specified files.")
+        return
+
+    import uuid
+    codevoight_dir, db_path = get_repo_and_db_paths()
+    repo = StateRepository(db_path)
+    diff_hash = compute_diff_hash(staged_diff)
+
+    gen = DeterministicQuizGenerator()
+    questions = gen.generate_quiz(staged_diff, description)
+
+    now = time.time()
+    session = StagedSession(
+        session_id=str(uuid.uuid4())[:8],
+        diff_text=staged_diff,
+        diff_hash=diff_hash,
+        description=description,
+        status=SessionStatus.PENDING_QUIZ,
+        created_at=now,
+        expires_at=now + 1800.0,
+    )
+
+    repo.create_session(session, questions)
+    click.echo(f"[SUCCESS] Staged session created: {session.session_id}")
+    click.echo(f"Run 'codevoight quiz {session.session_id}' to take the quiz and unlock commit.")
+
+
+if __name__ == "__main__":
+    main()

codevoight/core/config.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Optional
+
+
+def load_dotenv(env_path: Optional[Path] = None) -> None:
+    """Load key-value pairs from .env into os.environ without overriding existing keys."""
+    target = env_path or (Path.cwd() / ".env")
+    if not target.exists():
+        return
+
+    try:
+        content = target.read_text(encoding="utf-8")
+    except Exception:
+        return
+
+    for line in content.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, val = line.split("=", 1)
+        key = key.strip()
+        val = val.strip().strip("\"'")
+        if key and key not in os.environ:
+            os.environ[key] = val
+
+
+def get_token_ttl() -> float:
+    """Return capability token TTL in seconds (default: 1800.0)."""
+    val = os.getenv("CODEVOIGHT_TOKEN_TTL") or os.getenv("QUIZGATE_TOKEN_TTL") or os.getenv("CODEGATE_TOKEN_TTL")
+    if val:
+        try:
+            return float(val)
+        except ValueError:
+            pass
+    return 1800.0
+
+
+def get_passing_score() -> float:
+    """Return required quiz passing score between 0.0 and 1.0 (default: 1.0)."""
+    val = os.getenv("CODEVOIGHT_PASSING_SCORE") or os.getenv("QUIZGATE_PASSING_SCORE") or os.getenv("CODEGATE_PASSING_SCORE")
+    if val:
+        try:
+            score = float(val)
+            if 0.0 <= score <= 1.0:
+                return score
+        except ValueError:
+            pass
+    return 1.0

codevoight/core/diff.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import difflib
+import hashlib
+from typing import List, Optional
+
+from codevoight.core.models import StagedFile
+
+
+def normalize_text(text: Optional[str]) -> str:
+    """Normalize line endings to LF and strip trailing empty lines."""
+    if text is None:
+        return ""
+    normalized = text.replace("\r\n", "\n").replace("\r", "\n")
+    return normalized
+
+
+def generate_file_diff(file_path: str, old_content: Optional[str], new_content: str) -> str:
+    """Generate a unified diff string for a single file."""
+    norm_old = normalize_text(old_content).splitlines(keepends=True)
+    norm_new = normalize_text(new_content).splitlines(keepends=True)
+
+    from_file = f"a/{file_path}" if old_content is not None else "/dev/null"
+    to_file = f"b/{file_path}"
+
+    diff_lines = list(
+        difflib.unified_diff(
+            norm_old,
+            norm_new,
+            fromfile=from_file,
+            tofile=to_file,
+            lineterm="\n",
+        )
+    )
+    return "".join(diff_lines)
+
+
+def generate_diff(files: List[StagedFile]) -> str:
+    """Generate combined unified diff across multiple staged files."""
+    chunks = []
+    for f in sorted(files, key=lambda x: x.file_path):
+        d = generate_file_diff(f.file_path, f.old_content, f.new_content)
+        if d:
+            chunks.append(d)
+    return "\n".join(chunks)
+
+
+def compute_diff_hash(diff_text: str) -> str:
+    """Compute deterministic SHA-256 hash of normalized unified diff."""
+    norm = normalize_text(diff_text).strip()
+    return hashlib.sha256(norm.encode("utf-8")).hexdigest()

codevoight/core/models.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from enum import Enum
+from typing import List, Optional
+from pydantic import BaseModel, Field
+
+
+class SessionStatus(str, Enum):
+    PENDING_QUIZ = "PENDING_QUIZ"
+    APPROVED = "APPROVED"
+    REJECTED = "REJECTED"
+    EXPIRED = "EXPIRED"
+    CONSUMED = "CONSUMED"
+
+
+class StagedFile(BaseModel):
+    file_path: str
+    new_content: str
+    old_content: Optional[str] = None
+    is_new: bool = False
+    is_deleted: bool = False
+
+
+class QuizOption(BaseModel):
+    id: str  # "A", "B", "C", "D"
+    text: str
+
+
+class QuizQuestion(BaseModel):
+    id: str
+    prompt: str
+    options: List[QuizOption]
+    correct_option_id: str
+    explanation: str
+
+
+class QuizSubmission(BaseModel):
+    session_id: str
+    answers: dict[str, str]  # question_id -> chosen_option_id
+
+
+class QuizResult(BaseModel):
+    session_id: str
+    passed: bool
+    score: float
+    total: int
+    correct: int
+    feedback: List[str] = Field(default_factory=list)
+    capability_token: Optional[str] = None
+
+
+class CapabilityToken(BaseModel):
+    session_id: str
+    diff_hash: str
+    timestamp: int
+    signature: str
+
+    def serialize(self) -> str:
+        return f"{self.session_id}:{self.diff_hash}:{self.timestamp}:{self.signature}"
+
+    @classmethod
+    def parse(cls, raw: str) -> CapabilityToken:
+        parts = raw.split(":")
+        if len(parts) != 4:
+            raise ValueError("Malformed capability token format")
+        return cls(
+            session_id=parts[0],
+            diff_hash=parts[1],
+            timestamp=int(parts[2]),
+            signature=parts[3],
+        )
+
+
+class StagedSession(BaseModel):
+    session_id: str
+    diff_text: str
+    diff_hash: str
+    description: str = ""
+    status: SessionStatus = SessionStatus.PENDING_QUIZ
+    created_at: float
+    expires_at: float
+    capability_token: Optional[str] = None

codevoight/core/security.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import hmac
+import hashlib
+import os
+import secrets
+import time
+from pathlib import Path
+from typing import Optional
+
+from codevoight.core.models import CapabilityToken
+
+
+DEFAULT_TTL_SECONDS = 1800.0  # 30 minutes
+
+
+def get_or_create_secret(secret_dir: Path) -> bytes:
+    """Retrieve or generate a 32-byte cryptographic secret stored in secret_dir/.secret."""
+    secret_dir.mkdir(parents=True, exist_ok=True)
+    secret_path = secret_dir / ".secret"
+
+    if secret_path.exists():
+        secret_bytes = secret_path.read_bytes().strip()
+        if len(secret_bytes) >= 32:
+            return secret_bytes
+
+    new_secret = secrets.token_bytes(32)
+    # Write with restricted permissions
+    secret_path.write_bytes(new_secret)
+    return new_secret
+
+
+def sign_token(session_id: str, diff_hash: str, secret_key: bytes, timestamp: Optional[int] = None) -> CapabilityToken:
+    """Generate an HMAC-SHA256 capability token for a verified session diff."""
+    ts = int(timestamp) if timestamp is not None else int(time.time())
+    payload = f"{session_id}:{diff_hash}:{ts}".encode("utf-8")
+    sig = hmac.new(secret_key, payload, hashlib.sha256).hexdigest()
+    return CapabilityToken(
+        session_id=session_id,
+        diff_hash=diff_hash,
+        timestamp=ts,
+        signature=sig,
+    )
+
+
+def verify_token(
+    token: CapabilityToken,
+    expected_diff_hash: str,
+    secret_key: bytes,
+    ttl_seconds: float = DEFAULT_TTL_SECONDS,
+    current_time: Optional[float] = None,
+) -> bool:
+    """Verify validity, expiration, and cryptographic signature of a capability token."""
+    now = current_time if current_time is not None else time.time()
+
+    # Expiry check
+    if now - token.timestamp > ttl_seconds or token.timestamp > now + 60.0:
+        return False
+
+    # Diff hash match check (constant time)
+    if not hmac.compare_digest(token.diff_hash, expected_diff_hash):
+        return False
+
+    # Signature recomputation
+    payload = f"{token.session_id}:{token.diff_hash}:{token.timestamp}".encode("utf-8")
+    expected_sig = hmac.new(secret_key, payload, hashlib.sha256).hexdigest()
+
+    return hmac.compare_digest(token.signature, expected_sig)