diffsage 1.3.0__tar.gz → 1.4.0__tar.gz

{diffsage-1.3.0/src/diffsage.egg-info → diffsage-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffsage
-Version: 1.3.0
+Version: 1.4.0
 Summary: AI-powered Git workflow assistant
 Author: Gunitha Rathnayake
 License: MIT
@@ -26,7 +26,6 @@ Requires-Dist: platformdirs>=4.0.0
 Requires-Dist: tomlkit<1,>=0.13
 Requires-Dist: httpx<0.29,>=0.28
 Requires-Dist: PyYAML<7,>=6.0
-Requires-Dist: python-dotenv<2,>=1.1
 Requires-Dist: google-genai<2,>=1
 Provides-Extra: dev
 Requires-Dist: pytest<10,>=9; extra == "dev"
@@ -35,6 +34,7 @@ Requires-Dist: ruff<0.13,>=0.12; extra == "dev"
 Requires-Dist: pre-commit<5,>=4; extra == "dev"
 Requires-Dist: build<2,>=1; extra == "dev"
 Requires-Dist: pip-audit<3,>=2; extra == "dev"
+Requires-Dist: mypy<2,>=1.18; extra == "dev"
 Dynamic: license-file
 
 # DiffSage
@@ -234,7 +234,7 @@ pipx install diffsage
 A specific version can be installed with:
 
 ```bash
-pipx install diffsage==1.2.0
+pipx install diffsage==1.4.0
 ```
 
 Release builds and PyPI publishing are automated through GitHub Actions.
@@ -270,12 +270,45 @@ diffsage config unset provider
 
 ---
 
+# What Is Sent to the AI Provider
+
+`diffsage commit` and `diffsage pr` send your Git diff to the configured AI provider. Before
+anything is sent, DiffSage:
+
+- omits the contents of files that usually hold secrets (`.env`, `.env.*`, `*.pem`, `*.key`,
+  SSH keys, `.npmrc`, ...); `.env.example`-style templates are sent with their values redacted
+- omits lockfile contents (`package-lock.json`, `poetry.lock`, `uv.lock`, ...)
+- replaces values that look like credentials with `[REDACTED]`: Google, GitHub, AWS, Slack,
+  OpenAI and Anthropic keys, private key blocks, and `key = "value"` style secret assignments
+- limits the diff to 100,000 characters, keeping whole files and listing any that are left out
+
+Whenever something is removed, DiffSage prints a `!` notice, so nothing is hidden silently.
+This is a safety net, not a guarantee: review what you stage, and keep secrets out of
+your repository.
+
+---
+
 # Quick Start
 
-Set up your provider credential:
+Set up your provider credential. DiffSage asks for the API key at a hidden prompt, so it
+never appears on screen, in your shell history or in the process list:
+
+```bash
+diffsage auth set gemini
+```
+
+In scripts, pipe the key in instead of typing it:
+
+```bash
+printf '%s\n' "$GEMINI_API_KEY" | diffsage auth set gemini
+```
+
+In CI or containers you can skip the credentials file entirely and provide the key through
+the `DIFFSAGE_API_KEY` environment variable. When it is set, it is used instead of any
+stored credential, and `diffsage auth list` says so:
 
 ```bash
-diffsage auth set gemini YOUR_API_KEY
+DIFFSAGE_API_KEY="$GEMINI_API_KEY" diffsage pr
 ```
 
 Verify your environment:
@@ -349,7 +382,15 @@ Display PR URL
 Named credential profiles are also supported:
 
 ```bash
-diffsage auth set gemini YOUR_API_KEY --name paid
+diffsage auth set gemini --name paid
+```
+
+Choose which profile AI commands use with the `credential_profile` setting, per repository
+or globally, or for a single run with `DIFFSAGE_CREDENTIAL_PROFILE`:
+
+```bash
+diffsage config set credential_profile paid --local
+DIFFSAGE_CREDENTIAL_PROFILE=paid diffsage pr
 ```
 
 View configured credentials:

{diffsage-1.3.0 → diffsage-1.4.0}/README.md

@@ -195,7 +195,7 @@ pipx install diffsage
 A specific version can be installed with:
 
 ```bash
-pipx install diffsage==1.2.0
+pipx install diffsage==1.4.0
 ```
 
 Release builds and PyPI publishing are automated through GitHub Actions.
@@ -231,12 +231,45 @@ diffsage config unset provider
 
 ---
 
+# What Is Sent to the AI Provider
+
+`diffsage commit` and `diffsage pr` send your Git diff to the configured AI provider. Before
+anything is sent, DiffSage:
+
+- omits the contents of files that usually hold secrets (`.env`, `.env.*`, `*.pem`, `*.key`,
+  SSH keys, `.npmrc`, ...); `.env.example`-style templates are sent with their values redacted
+- omits lockfile contents (`package-lock.json`, `poetry.lock`, `uv.lock`, ...)
+- replaces values that look like credentials with `[REDACTED]`: Google, GitHub, AWS, Slack,
+  OpenAI and Anthropic keys, private key blocks, and `key = "value"` style secret assignments
+- limits the diff to 100,000 characters, keeping whole files and listing any that are left out
+
+Whenever something is removed, DiffSage prints a `!` notice, so nothing is hidden silently.
+This is a safety net, not a guarantee: review what you stage, and keep secrets out of
+your repository.
+
+---
+
 # Quick Start
 
-Set up your provider credential:
+Set up your provider credential. DiffSage asks for the API key at a hidden prompt, so it
+never appears on screen, in your shell history or in the process list:
+
+```bash
+diffsage auth set gemini
+```
+
+In scripts, pipe the key in instead of typing it:
+
+```bash
+printf '%s\n' "$GEMINI_API_KEY" | diffsage auth set gemini
+```
+
+In CI or containers you can skip the credentials file entirely and provide the key through
+the `DIFFSAGE_API_KEY` environment variable. When it is set, it is used instead of any
+stored credential, and `diffsage auth list` says so:
 
 ```bash
-diffsage auth set gemini YOUR_API_KEY
+DIFFSAGE_API_KEY="$GEMINI_API_KEY" diffsage pr
 ```
 
 Verify your environment:
@@ -310,7 +343,15 @@ Display PR URL
 Named credential profiles are also supported:
 
 ```bash
-diffsage auth set gemini YOUR_API_KEY --name paid
+diffsage auth set gemini --name paid
+```
+
+Choose which profile AI commands use with the `credential_profile` setting, per repository
+or globally, or for a single run with `DIFFSAGE_CREDENTIAL_PROFILE`:
+
+```bash
+diffsage config set credential_profile paid --local
+DIFFSAGE_CREDENTIAL_PROFILE=paid diffsage pr
 ```
 
 View configured credentials:

{diffsage-1.3.0 → diffsage-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "diffsage"
-version = "1.3.0"
+version = "1.4.0"
 description = "AI-powered Git workflow assistant"
 readme = "README.md"
 requires-python = ">=3.12,<3.13"
@@ -41,7 +41,6 @@ dependencies = [
     "tomlkit>=0.13,<1",
     "httpx>=0.28,<0.29",
     "PyYAML>=6.0,<7",
-    "python-dotenv>=1.1,<2",
     "google-genai>=1,<2",
 ]
 
@@ -53,6 +52,7 @@ dev = [
     "pre-commit>=4,<5",
     "build>=1,<2",
     "pip-audit>=2,<3",
+    "mypy>=1.18,<2",
 ]
 
 [project.scripts]
@@ -80,4 +80,24 @@ line-length = 100
 target-version = "py312"
 
 [tool.ruff.lint]
-select = ["E", "F", "I", "UP", "B"]
+select = ["E", "F", "I", "UP", "B", "ARG"]
+
+[tool.mypy]
+python_version = "3.12"
+files = ["src"]
+warn_unused_configs = true
+warn_redundant_casts = true
+warn_unused_ignores = true
+
+# Temporary baseline: these modules have known type errors that are fixed by
+# later remediation branches. Each branch removes its modules from this list.
+[[tool.mypy.overrides]]
+module = [
+    # feature/ai-provider-hardening
+    "diffsage.providers.gemini_provider",
+    "diffsage.services.ai_service",
+    # chore/cleanup
+    "diffsage.ui.auth_view",
+    "diffsage.ui.config_view",
+]
+ignore_errors = true

diffsage-1.4.0/src/diffsage/cli.py

@@ -0,0 +1,79 @@
+import logging
+from importlib.metadata import version
+
+import typer
+
+from diffsage.commands.ask import ask
+from diffsage.commands.auth import app as auth_app
+from diffsage.commands.commit import commit
+from diffsage.commands.config import app as config_app
+from diffsage.commands.doctor import doctor
+from diffsage.commands.error_handler import handle_command_errors
+from diffsage.commands.pr import pr
+from diffsage.config.loader import load_settings
+from diffsage.exceptions import ConfigError
+from diffsage.logging.logger import configure_logging
+
+app = typer.Typer(help="DiffSage: AI-aware Git workflow toolkit")
+
+# Commands that must run even when the configuration is invalid, so it can be
+# repaired (`config`) or diagnosed (`doctor`).
+CONFIG_TOLERANT_COMMANDS = {"config", "doctor"}
+
+
+def version_callback(value: bool) -> None:
+    if value:
+        typer.echo(version("diffsage"))
+        raise typer.Exit()
+
+
+@app.callback()
+@handle_command_errors("diffsage")
+def main(
+    ctx: typer.Context,
+    _version: bool = typer.Option(
+        False,
+        "--version",
+        "-v",
+        callback=version_callback,
+        is_eager=True,
+        help="Show the Diffsage version.",
+    ),
+) -> None:
+    """
+    Initialize DiffSage.
+    """
+    try:
+        settings = load_settings()
+    except ConfigError:
+        # Start the log file at the default level so the error handler's warning is
+        # written there, instead of to stderr through Python's last-resort handler.
+        configure_logging()
+
+        if ctx.invoked_subcommand in CONFIG_TOLERANT_COMMANDS:
+            return
+
+        raise
+
+    configure_logging(
+        getattr(
+            logging,
+            settings.log_level.upper(),
+            logging.INFO,
+        )
+    )
+
+
+app.command()(doctor)
+app.command()(ask)
+app.command()(commit)
+app.command()(pr)
+
+app.add_typer(
+    config_app,
+    name="config",
+)
+app.add_typer(
+    auth_app,
+    name="auth",
+)

diffsage-1.4.0/src/diffsage/commands/ask.py

@@ -0,0 +1,32 @@
+from diffsage.commands.error_handler import handle_command_errors
+from diffsage.config.loader import load_settings
+from diffsage.config.paths import get_credentials_path
+from diffsage.logging.logger import get_logger
+from diffsage.services.ai_service import AIService
+from diffsage.services.credentials_service import CredentialService
+from diffsage.storage.credentials_repository import CredentialsRepository
+from diffsage.ui.ask_view import AskView
+
+logger = get_logger(__name__)
+
+
+@handle_command_errors("ask")
+def ask(prompt: str) -> None:
+    """Ask the configured AI provider a question"""
+
+    logger.info("Running ask command")
+    view = AskView()
+
+    settings = load_settings()
+
+    credential_path = get_credentials_path()
+    repository = CredentialsRepository(credential_path)
+    credential_service = CredentialService(repository)
+
+    service = AIService(
+        settings,
+        credential_service,
+    )
+
+    response = service.ask(prompt)
+    view.show_response(response)

diffsage-1.4.0/src/diffsage/commands/auth.py

@@ -0,0 +1,147 @@
+import sys
+
+import typer
+
+from diffsage.commands.error_handler import handle_command_errors
+from diffsage.config.paths import get_credentials_path
+from diffsage.exceptions import CredentialNotFoundError, InvalidCredentialError
+from diffsage.logging.logger import get_logger
+from diffsage.services.credentials_service import API_KEY_ENVIRONMENT_VARIABLE, CredentialService
+from diffsage.storage.credentials_repository import CredentialsRepository
+from diffsage.ui.auth_view import AuthView
+
+logger = get_logger(__name__)
+
+app = typer.Typer(
+    help="DiffSage credential management",
+    invoke_without_command=False,
+)
+
+
+def _stdin_is_terminal() -> bool:
+    return sys.stdin.isatty()
+
+
+def _read_api_key(provider: str) -> str:
+    """Ask for the key at a hidden prompt, or read it from piped input."""
+
+    if _stdin_is_terminal():
+        return typer.prompt(f"API key for {provider}", hide_input=True)
+
+    # Piped input (scripts, CI): nothing to hide on screen, so no prompt. Using the
+    # hidden prompt here would print getpass's "input may be echoed" warning.
+    api_key = sys.stdin.readline().strip()
+
+    if not api_key:
+        raise InvalidCredentialError("No API key was received on standard input.")
+
+    return api_key
+
+
+def _warn_if_environment_key_is_set(view: AuthView) -> None:
+    if CredentialService.environment_api_key() is not None:
+        view.show_warning(
+            f"{API_KEY_ENVIRONMENT_VARIABLE} is set, so AI commands use it instead of "
+            "stored credentials."
+        )
+
+
+def _credential_service() -> CredentialService:
+    path = get_credentials_path()
+    repository = CredentialsRepository(path)
+    return CredentialService(repository)
+
+
+@app.command("set")
+@handle_command_errors("auth set")
+def set_credential(
+    provider: str,
+    name: str = typer.Option(
+        "default",
+        "--name",
+        help="Credential profile name.",
+    ),
+) -> None:
+    """Store a DiffSage provider credential.
+
+    The API key is entered at a hidden prompt, never as an argument.
+
+    For scripts, pipe it in: printf '%s\\n' "$KEY" | diffsage auth set gemini
+    """
+
+    view = AuthView()
+
+    api_key = _read_api_key(provider)
+
+    _credential_service().set_credential(
+        provider,
+        api_key,
+        name,
+    )
+
+    view.show_success("Credential saved.")
+
+
+@app.command("get")
+@handle_command_errors("auth get")
+def get_credential(
+    provider: str,
+    name: str = typer.Option(
+        "default",
+        "--name",
+        help="Credential profile name.",
+    ),
+) -> None:
+    """Get a DiffSage provider credential."""
+
+    view = AuthView()
+
+    credential = _credential_service().get_credential(
+        provider,
+        name,
+    )
+
+    _warn_if_environment_key_is_set(view)
+
+    if credential is None:
+        raise CredentialNotFoundError(provider, name)
+
+    view.show_credential(credential)
+
+
+@app.command("list")
+@handle_command_errors("auth list")
+def list_credentials() -> None:
+    """List configured DiffSage credentials."""
+
+    view = AuthView()
+
+    credentials = _credential_service().list_credentials()
+
+    _warn_if_environment_key_is_set(view)
+    view.show_credentials(credentials)
+
+
+@app.command("unset")
+@handle_command_errors("auth unset")
+def unset_credential(
+    provider: str,
+    name: str = typer.Option(
+        "default",
+        "--name",
+        help="Credential profile name.",
+    ),
+) -> None:
+    """Unset DiffSage provider credential."""
+
+    view = AuthView()
+
+    deleted = _credential_service().delete_credential(
+        provider,
+        name,
+    )
+
+    if not deleted:
+        raise CredentialNotFoundError(provider, name)
+
+    view.show_success("Credential removed.")

diffsage-1.4.0/src/diffsage/commands/commit.py

@@ -0,0 +1,142 @@
+from collections.abc import Callable
+
+from diffsage.commands.error_handler import handle_command_errors
+from diffsage.config.loader import load_settings
+from diffsage.config.paths import get_credentials_path
+from diffsage.exceptions import InvalidCommitMessageError
+from diffsage.git.client import GitClient
+from diffsage.logging.logger import get_logger
+from diffsage.parsers.commit_message_parser import CommitMessageParser
+from diffsage.services.ai_service import AIService
+from diffsage.services.commit_service import CommitService
+from diffsage.services.credentials_service import CredentialService
+from diffsage.services.editor_service import EditorService
+from diffsage.services.git_service import GitService
+from diffsage.services.prompt_service import PromptService
+from diffsage.storage.credentials_repository import CredentialsRepository
+from diffsage.ui.commit_view import CommitView
+
+logger = get_logger(__name__)
+
+
+def generate_message(
+    commit_service: CommitService,
+    on_attempt: Callable[[int, int], None] | None = None,
+    on_notice: Callable[[str], None] | None = None,
+) -> str:
+    return commit_service.generate_commit_message(
+        on_attempt=on_attempt,
+        on_notice=on_notice,
+    )
+
+
+@handle_command_errors("commit")
+def commit() -> None:
+    """Generate a conventional commit message"""
+
+    git_client = GitClient()
+    view = CommitView()
+    editor = EditorService()
+
+    settings = load_settings()
+
+    credential_path = get_credentials_path()
+    credential_repository = CredentialsRepository(credential_path)
+    credential_service = CredentialService(credential_repository)
+
+    git_service = GitService(git_client)
+    ai_service = AIService(
+        settings,
+        credential_service,
+    )
+    prompt_service = PromptService()
+
+    commit_service = CommitService(
+        git_client,
+        git_service,
+        prompt_service,
+        ai_service,
+    )
+
+    with view.generating() as status:
+        raw_message = generate_message(
+            commit_service,
+            on_attempt=lambda attempt, total: status.update(
+                f"Generating commit message... Attempt {attempt}/{total}"
+            ),
+            on_notice=view.show_warning,
+        )
+        commit_message = CommitMessageParser.parse(raw_message)
+
+    view.show_generated()
+    view.show_commit(commit_message)
+
+    # Text of an edit that did not parse; the next E reopens it so nothing typed is lost.
+    pending_edit: str | None = None
+
+    while True:
+        choice = view.prompt_action()
+
+        if choice in ("", "y"):
+            logger.info("User selected commit.")
+            # Commit the cleaned message: no code fences or preamble from the AI reply.
+            message_text = commit_message.to_text()
+            git_client.commit(message_text)
+            view.show_success(message_text)
+            break
+
+        if choice == "e":
+            logger.info("User selected edit.")
+            edited = editor.edit(pending_edit or commit_message.to_text())
+
+            if edited is None:
+                view.show_warning("Edit cancelled. The message below is unchanged.")
+                view.show_commit(commit_message)
+                continue
+
+            try:
+                commit_message = CommitMessageParser.parse(edited)
+            except InvalidCommitMessageError as error:
+                pending_edit = edited
+                view.show_error(error.message)
+                view.show_warning(
+                    "Your edit was kept. Press E to continue editing it. The message below "
+                    "is unchanged, and Y commits it."
+                )
+            else:
+                pending_edit = None
+
+            view.show_commit(commit_message)
+            continue
+
+        if choice == "r":
+            logger.info("User selected regenerate.")
+            with view.generating() as status:
+                raw_message = generate_message(
+                    commit_service,
+                    on_attempt=lambda attempt, total: status.update(
+                        f"Generating commit message... Attempt {attempt}/{total}"
+                    ),
+                    on_notice=view.show_warning,
+                )
+
+            try:
+                commit_message = CommitMessageParser.parse(raw_message)
+            except InvalidCommitMessageError as error:
+                view.show_error(error.message)
+                view.show_warning(
+                    "The new suggestion could not be used. The message below is unchanged."
+                )
+            else:
+                pending_edit = None
+                view.show_generated()
+
+            view.show_commit(commit_message)
+            continue
+
+        if choice == "n":
+            logger.info("User cancelled commit.")
+            view.show_cancelled()
+            break
+
+        view.show_invalid_option()