devtorch-core 3.0.1__py3-none-any.whl

devtorch_core/hooks/git_capture.py

@@ -0,0 +1,341 @@
+"""
+S26 git capture hooks — always-on capture for commit, merge, checkout, rebase,
+and conflict events.
+
+Entry point: devtorch hooks git-capture <event> [args...]
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from pathlib import Path
+from typing import Optional
+
+
+# ---------------------------------------------------------------------------
+# .GCC/ repo discovery
+# ---------------------------------------------------------------------------
+
+
+def _find_repo() -> Optional[object]:
+    """Walk upward from cwd to find an initialised .GCC/ repo."""
+    from devtorch_core import GCCRepository
+
+    for parent in [Path.cwd()] + list(Path.cwd().parents):
+        r = GCCRepository.at(parent)
+        if r.is_initialized():
+            return r
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Event appender
+# ---------------------------------------------------------------------------
+
+
+def _append_event(repo, event_type: str, payload: dict) -> None:
+    """Append a raw event to the repo's event log."""
+    try:
+        repo._append_event(event_type, payload)
+    except Exception:
+        # _append_event may not be public on all versions; fall back to
+        # writing directly to events.log.jsonl
+        try:
+            import fcntl
+            import hashlib
+            import time
+
+            log_path = Path(repo.gcc_dir) / "events.log.jsonl"
+            log_path.parent.mkdir(parents=True, exist_ok=True)
+            with log_path.open("a", encoding="utf-8") as f:
+                fcntl.flock(f, fcntl.LOCK_EX)
+                try:
+                    prev_hash = "0" * 64
+                    if log_path.exists():
+                        lines = log_path.read_text(encoding="utf-8").strip().splitlines()
+                        if lines:
+                            last = json.loads(lines[-1])
+                            prev_hash = last.get("hash", prev_hash)
+
+                    entry = {
+                        "type": event_type,
+                        "ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+                        **payload,
+                    }
+                    entry_str = json.dumps(entry, sort_keys=True)
+                    entry["hash"] = hashlib.sha256(
+                        (prev_hash + entry_str).encode()
+                    ).hexdigest()
+
+                    f.write(json.dumps(entry) + "\n")
+                    f.flush()
+                finally:
+                    fcntl.flock(f, fcntl.LOCK_UN)
+        except Exception:
+            pass
+
+
+# ---------------------------------------------------------------------------
+# Git metadata helpers
+# ---------------------------------------------------------------------------
+
+
+def _run_git(repo_root: Path, *args: str, timeout: float = 10.0) -> str:
+    """Run a git command and return stripped stdout, or empty string on failure."""
+    try:
+        result = subprocess.run(
+            ["git", *args],
+            cwd=repo_root,
+            capture_output=True,
+            text=True,
+            check=True,
+            timeout=timeout,
+        )
+        return result.stdout.strip()
+    except Exception:
+        return ""
+
+
+def _current_branch(repo: object) -> str:
+    """Best-effort current branch name from git or GCC repo."""
+    try:
+        branch = _run_git(repo.root, "rev-parse", "--abbrev-ref", "HEAD")
+        if branch:
+            return branch
+    except Exception:
+        pass
+    return getattr(repo, "_current_branch", lambda: "main")()
+
+
+def _head_sha(repo: object, ref: str = "HEAD") -> str:
+    """Best-effort commit SHA for the given ref."""
+    return _run_git(repo.root, "rev-parse", ref)
+
+
+# ---------------------------------------------------------------------------
+# Merge conflict detection
+# ---------------------------------------------------------------------------
+
+
+_CONFLICT_MARKER_RE = re.compile(r"^(<{7}|={7}|>{7})", re.MULTILINE)
+
+
+def _has_conflict_markers(repo_root: Path) -> bool:
+    """Scan tracked files in the working tree for conflict markers."""
+    try:
+        # Ask git for files with changes (staged or unstaged)
+        result = subprocess.run(
+            ["git", "diff", "--name-only"],
+            cwd=repo_root,
+            capture_output=True,
+            text=True,
+            timeout=10.0,
+        )
+        files = result.stdout.strip().splitlines()
+        if not files:
+            # Also check staged diffs
+            result = subprocess.run(
+                ["git", "diff", "--cached", "--name-only"],
+                cwd=repo_root,
+                capture_output=True,
+                text=True,
+                timeout=10.0,
+            )
+            files = result.stdout.strip().splitlines()
+
+        for line in files:
+            fpath = repo_root / line
+            if fpath.is_file():
+                try:
+                    text = fpath.read_text(encoding="utf-8", errors="ignore")
+                    if _CONFLICT_MARKER_RE.search(text):
+                        return True
+                except Exception:
+                    pass
+    except Exception:
+        pass
+    return False
+
+
+def _merge_state_files(repo_root: Path) -> bool:
+    """Check the classic .git merge state files."""
+    git_dir = repo_root / ".git"
+    try:
+        if (git_dir / "MERGE_HEAD").exists():
+            return True
+        if (git_dir / "MERGE_MSG").exists():
+            return True
+    except Exception:
+        pass
+    return False
+
+
+def detect_merge_conflict(repo: object) -> bool:
+    """Detect whether the repository is currently in a merge conflict state."""
+    try:
+        repo_root = Path(repo.root)
+        if _merge_state_files(repo_root):
+            return True
+        if _has_conflict_markers(repo_root):
+            return True
+    except Exception:
+        pass
+    return False
+
+
+def _emit_conflict_if_detected(repo: object, trigger: str) -> None:
+    """Helper: emit a git_conflict event if the repo is in conflict state."""
+    if detect_merge_conflict(repo):
+        _append_event(repo, "git_conflict", {
+            "branch": _current_branch(repo),
+            "trigger": trigger,
+            "kind": "merge_conflict",
+        })
+
+
+# ---------------------------------------------------------------------------
+# Git hook handlers
+# ---------------------------------------------------------------------------
+
+
+def handle_git_commit(event_name: str = "post-commit", args: Optional[list[str]] = None) -> None:
+    """post-commit hook entry point."""
+    repo = _find_repo()
+    if repo is None:
+        return
+    _append_event(repo, "git_commit", {
+        "branch": _current_branch(repo),
+        "commit_sha": _head_sha(repo, "HEAD"),
+        "hook": event_name,
+        "args": args or [],
+    })
+    _emit_conflict_if_detected(repo, event_name)
+
+
+def handle_git_merge(event_name: str = "post-merge", args: Optional[list[str]] = None) -> None:
+    """post-merge hook entry point."""
+    repo = _find_repo()
+    if repo is None:
+        return
+    branch = _current_branch(repo)
+    payload: dict = {
+        "branch": branch,
+        "hook": event_name,
+        "args": args or [],
+    }
+    if args:
+        payload["squash_flag"] = args[0]
+    _append_event(repo, "git_merge", payload)
+    _emit_conflict_if_detected(repo, event_name)
+
+
+def handle_git_checkout(event_name: str = "post-checkout", args: Optional[list[str]] = None) -> None:
+    """post-checkout hook entry point."""
+    repo = _find_repo()
+    if repo is None:
+        return
+    branch = _current_branch(repo)
+    arg_list = args or []
+    payload: dict = {
+        "branch": branch,
+        "hook": event_name,
+        "args": arg_list,
+    }
+    if len(arg_list) > 0:
+        payload["prev_head"] = arg_list[0]
+    if len(arg_list) > 1:
+        payload["new_head"] = arg_list[1]
+    if len(arg_list) > 2:
+        payload["flag"] = arg_list[2]
+    _append_event(repo, "git_checkout", payload)
+    _emit_conflict_if_detected(repo, event_name)
+
+
+def handle_git_rebase(event_name: str = "post-rewrite", args: Optional[list[str]] = None) -> None:
+    """post-rewrite hook entry point (rebase / amend)."""
+    repo = _find_repo()
+    if repo is None:
+        return
+    branch = _current_branch(repo)
+    command = (args or [""])[0] if args else ""
+    if command == "rebase":
+        _append_event(repo, "git_rebase", {
+            "branch": branch,
+            "hook": event_name,
+            "command": command,
+            "args": args or [],
+        })
+    _emit_conflict_if_detected(repo, event_name)
+
+
+def handle_git_conflict() -> None:
+    """Manual / helper invocation: emit a git_conflict event if in conflict."""
+    repo = _find_repo()
+    if repo is None:
+        return
+    _emit_conflict_if_detected(repo, "manual")
+
+
+# ---------------------------------------------------------------------------
+# Dispatch
+# ---------------------------------------------------------------------------
+
+_HANDLERS = {
+    "post-commit": handle_git_commit,
+    "post-merge": handle_git_merge,
+    "post-checkout": handle_git_checkout,
+    "post-rewrite": handle_git_rebase,
+    "conflict": handle_git_conflict,
+}
+
+
+def handle_git_capture(event_name: str, args: Optional[list[str]] = None) -> None:
+    """
+    Entry point called by `devtorch hooks git-capture <event> [args...]`.
+    Dispatches to the correct handler. Unknown events are ignored silently.
+    """
+    handler = _HANDLERS.get(event_name)
+    if handler:
+        try:
+            handler(event_name, args)
+        except Exception:
+            pass  # never interfere with git
+
+
+# ---------------------------------------------------------------------------
+# Hook installer
+# ---------------------------------------------------------------------------
+
+_GIT_CAPTURE_HOOKS: dict[str, str] = {
+    "post-commit": "devtorch hooks git-capture post-commit \"$@\"",
+    "post-merge": "devtorch hooks git-capture post-merge \"$@\"",
+    "post-checkout": "devtorch hooks git-capture post-checkout \"$@\"",
+    "post-rewrite": "devtorch hooks git-capture post-rewrite \"$@\"",
+}
+
+
+def install_git_capture_hooks(repo_root: Path | str) -> tuple[bool, dict[str, str]]:
+    """
+    Install the S26 git capture hooks in .git/hooks/.
+
+    Returns (all_ok, {hook_name: path or error_message}).
+    """
+    hooks_dir = Path(repo_root) / ".git" / "hooks"
+    if not hooks_dir.is_dir():
+        return False, {}
+
+    written: dict[str, str] = {}
+    all_ok = True
+    for hook_name, body in _GIT_CAPTURE_HOOKS.items():
+        hook_file = hooks_dir / hook_name
+        try:
+            hook_script = f"#!/bin/sh\n{body}\n"
+            hook_file.write_text(hook_script, encoding="utf-8")
+            hook_file.chmod(0o755)
+            written[hook_name] = str(hook_file)
+        except Exception as exc:
+            all_ok = False
+            written[hook_name] = str(exc)
+    return all_ok, written

devtorch_core/hooks/git_commit.py

@@ -0,0 +1,182 @@
+"""
+S7 git commit-msg hook — human developer capture.
+
+Intercepts git commits to record sensitivity signals and mirror the commit
+into .GCC/ so the reasoning audit trail stays in sync with the git history.
+
+Entry point: devtorch hooks git-commit <commit_msg_file>
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Optional
+
+
+# ---------------------------------------------------------------------------
+# Keyword → concept mapping
+# ---------------------------------------------------------------------------
+
+_CONCEPT_KEYWORDS: dict[str, list[str]] = {
+    "auth": ["auth", "login", "token", "oauth", "jwt", "session", "credential"],
+    "schema": ["schema", "migration", "alter", "column", "table", "model"],
+    "api": ["api", "endpoint", "route", "rest", "graphql", "grpc", "http"],
+    "deploy": ["deploy", "release", "publish", "rollout", "pipeline", "ci", "cd"],
+    "security": ["security", "vuln", "cve", "exploit", "xss", "sql", "injection", "sanitize"],
+    "performance": ["perf", "performance", "latency", "throughput", "cache", "index", "optimize"],
+    "config": ["config", "env", "setting", "feature-flag", "flag", "yaml", "toml"],
+}
+
+
+def _infer_concept(message: str) -> str:
+    """Return the best matching concept keyword for a commit message."""
+    # Strip DevTorch auto-capture prefix "[session=<UUID>] auto(conf=...):"
+    # and standard git trailers before keyword matching to avoid false positives
+    # ("auth" matching "Co-Authored-By", "session" matching "[session=UUID]").
+    cleaned = re.sub(r"^\[session=[^\]]+\]\s*auto\([^)]*\):[^\n]*\n?", "", message)
+    trailer_re = re.compile(
+        r"^(co-authored-by|signed-off-by|reviewed-by|acked-by|reported-by):.*$",
+        re.IGNORECASE | re.MULTILINE,
+    )
+    cleaned = trailer_re.sub("", cleaned)
+    lower = cleaned.lower()
+    for concept, keywords in _CONCEPT_KEYWORDS.items():
+        for kw in keywords:
+            if re.search(r"\b" + re.escape(kw) + r"\b", lower):
+                return concept
+    return "general"
+
+
+def _word_count(text: str) -> int:
+    return len(text.split())
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+
+def extract_sensitivity_from_commit(message: str) -> Optional[dict]:
+    """
+    Infer sensitivity signal from a git commit message.
+
+    Confidence tiers by message quality:
+    - > 50 words: 0.75 (substantive reasoning)
+    - > 20 words: 0.70 (reasonable explanation)
+    - >  5 words: 0.50 (brief note)
+    - <= 5 words: 0.40 (minimal — "fix bug", "wip")
+
+    Returns {"concept": str, "signal": str, "confidence": float}
+    or None if message is empty.
+    """
+    stripped = message.strip()
+    if not stripped:
+        return None
+
+    n_words = _word_count(stripped)
+    if n_words > 50:
+        confidence = 0.75
+    elif n_words > 20:
+        confidence = 0.70
+    elif n_words > 5:
+        confidence = 0.50
+    else:
+        confidence = 0.40
+
+    concept = _infer_concept(stripped)
+
+    return {
+        "concept": concept,
+        "signal": stripped,
+        "confidence": confidence,
+    }
+
+
+def _find_gcc_repo() -> Optional[object]:
+    """Walk upward from cwd to find an initialised .GCC/ repository."""
+    from devtorch_core import GCCRepository
+
+    for parent in [Path.cwd()] + list(Path.cwd().parents):
+        r = GCCRepository.at(parent)
+        if r.is_initialized():
+            return r
+    return None
+
+
+def handle_commit_msg(commit_msg_file: str) -> None:
+    """
+    Git commit-msg hook entry point.
+
+    Reads commit message from commit_msg_file.
+    Finds .GCC/ by walking up from cwd.
+    Creates SensitivityEvent and calls repo.add_sensitivity().
+    Also calls repo.commit(message=git_message).
+    All errors are silent — never interfere with git commit.
+    """
+    try:
+        git_message = Path(commit_msg_file).read_text(encoding="utf-8").strip()
+        if not git_message:
+            return
+
+        sensitivity_data = extract_sensitivity_from_commit(git_message)
+        if sensitivity_data is None:
+            return
+
+        repo = _find_gcc_repo()
+        if repo is None:
+            return
+
+        from devtorch_core.sensitivity import SensitivityEvent
+
+        ev = SensitivityEvent(
+            source_node="git-commit-hook",
+            target_concept=sensitivity_data["concept"],
+            counterfactuals=sensitivity_data["signal"],
+            confidence=sensitivity_data["confidence"],
+            disclosure_level="PROTECTED",
+            message=git_message,
+        )
+        repo.add_sensitivity(ev)
+        repo.commit(message=git_message)
+
+    except Exception:
+        # Never interfere with git commit
+        pass
+
+
+def install_hook(repo_path: Optional[Path] = None) -> None:
+    """
+    Install the git commit-msg hook in .git/hooks/commit-msg.
+
+    Creates a shell script that calls: devtorch hooks git-commit "$1"
+    Makes it executable.
+    """
+    if repo_path is None:
+        repo_path = Path.cwd()
+
+    hooks_dir = repo_path / ".git" / "hooks"
+    if not hooks_dir.is_dir():
+        raise FileNotFoundError(
+            f"No .git/hooks/ directory found at {repo_path}. "
+            "Are you inside a git repository?"
+        )
+
+    hook_file = hooks_dir / "commit-msg"
+    hook_script = "#!/bin/sh\ndevtorch hooks git-commit \"$1\"\n"
+    hook_file.write_text(hook_script, encoding="utf-8")
+    hook_file.chmod(0o755)
+
+
+def main() -> None:
+    """Entry point: devtorch hooks git-commit <commit_msg_file>"""
+    if len(sys.argv) < 2:
+        sys.stderr.write(
+            "Usage: devtorch hooks git-commit <commit_msg_file>\n"
+        )
+        sys.exit(1)
+
+    commit_msg_file = sys.argv[1]
+    handle_commit_msg(commit_msg_file)