git-cai-cli 0.15.1__tar.gz → 0.15.2__tar.gz

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/.mega-linter.yml

@@ -67,6 +67,7 @@ REPOSITORY_SEMGREP_RULESETS:
     "p/r2c-security-audit",
     "p/secure-defaults",
   ]
+SECURITY_SUGGESTIONS: false
 SHOW_ELAPSED_TIME: true
 SHOW_SKIPPED_LINTERS: true
 SPELL_PROSELINT_RULES_PATH: .linters

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-cai-cli
-Version: 0.15.1
+Version: 0.15.2
 Summary: Use LLM to create git commit messages
 Author-email: Thorsten Foltz <thorsten.foltz@live.com>
 License-Expression: MIT

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/docs/git-cai.txt

@@ -914,7 +914,18 @@ Available configuration keys:
   credential formats are flagged (private keys, AWS/GitHub/Slack/Google/OpenAI
   keys); obvious placeholders (values containing `example`, `sample`, `dummy`,
   and repeated-character filler) are ignored. Local providers (Ollama) skip the
-  scan, since nothing leaves the machine.
+  scan, since nothing leaves the machine. When you confirm a flagged send in an
+  interactive commit (a false alarm), git-cai offers, per flagged file, to
+  remember the decision: add the file to `.caiignore` (drop it from git-cai
+  entirely), add it to `secret_scan_exclude` (keep sending it but skip its
+  scan), or skip (remember nothing).
+- `secret_scan_exclude` -- list of repo-relative paths whose contents are
+  exempt from the secret scan while still being sent to the LLM (default empty).
+  Use this for files that keep tripping a false positive (such as test fixtures)
+  but that you still want git-cai to see. Paths are matched with gitignore
+  semantics, like `.caiignore`, so directory patterns work too. The
+  false-alarm prompt writes here when you choose "keep, skip scan", targeting
+  the repository `cai_config.yml` if one exists, otherwise the home config.
 - `load_tokens_from` -- path to the tokens file
 - `prompt_file` -- path to the commit prompt Markdown file
 - `squash_prompt_file` -- path to the squash prompt Markdown file

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/docs/man/git-cai.1

@@ -2,12 +2,12 @@
 .\"     Title: git-cai
 .\"    Author: Thorsten Foltz
 .\" Generator: Asciidoctor 2.0.26
-.\"      Date: 2026-06-19
+.\"      Date: 2026-06-24
 .\"    Manual: \ \&
 .\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "GIT\-CAI" "1" "2026-06-19" "\ \&" "\ \&"
+.TH "GIT\-CAI" "1" "2026-06-24" "\ \&" "\ \&"
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .ss \n[.ss] 0
@@ -1456,7 +1456,28 @@ match the send is blocked and you are asked to confirm (or pass
 credential formats are flagged (private keys, AWS/GitHub/Slack/Google/OpenAI
 keys); obvious placeholders (values containing \f(CRexample\fP, \f(CRsample\fP, \f(CRdummy\fP,
 and repeated\-character filler) are ignored. Local providers (Ollama) skip the
-scan, since nothing leaves the machine.
+scan, since nothing leaves the machine. When you confirm a flagged send in an
+interactive commit (a false alarm), git\-cai offers, per flagged file, to
+remember the decision: add the file to \f(CR.caiignore\fP (drop it from git\-cai
+entirely), add it to \f(CRsecret_scan_exclude\fP (keep sending it but skip its
+scan), or skip (remember nothing).
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\f(CRsecret_scan_exclude\fP \(em list of repo\-relative paths whose contents are
+exempt from the secret scan while still being sent to the LLM (default empty).
+Use this for files that keep tripping a false positive (such as test fixtures)
+but that you still want git\-cai to see. Paths are matched with gitignore
+semantics, like \f(CR.caiignore\fP, so directory patterns work too. The
+false\-alarm prompt writes here when you choose "keep, skip scan", targeting
+the repository \f(CRcai_config.yml\fP if one exists, otherwise the home config.
 .RE
 .sp
 .RS 4

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.15.1'
-__version_tuple__ = version_tuple = (0, 15, 1)
+__version__ = version = '0.15.2'
+__version_tuple__ = version_tuple = (0, 15, 2)
 
-__commit_id__ = commit_id = 'g00cc1e8ad'
+__commit_id__ = commit_id = 'g12ea7cd4d'

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/config.py

@@ -67,6 +67,7 @@ DEFAULT_CONFIG: dict[str, Any] = {
     "stats": False,
     "signoff": False,
     "secret_scan": True,
+    "secret_scan_exclude": [],
 }
 
 # Providers that do not require an API token in tokens.yml
@@ -588,6 +589,43 @@ def set_config_value(key: str, raw_value: str, *, force_home: bool = False) -> P
     return target
 
 
+def add_to_secret_scan_exclude(path: str, *, force_home: bool = False) -> Path:
+    """Append ``path`` to ``secret_scan_exclude`` in the active config file.
+
+    Targets the repo ``cai_config.yml`` if one exists, otherwise the home
+    config. Unlike :func:`set_config_value`, this never errors when no repo
+    config is present — it falls back to home, matching the "local if exists,
+    otherwise global" rule. The append is idempotent (dedup).
+
+    Returns the path to the config file that was written.
+    """
+    repo_config = None if force_home else _find_repo_config()
+    target = repo_config if repo_config else FALLBACK_CONFIG_FILE
+
+    target.parent.mkdir(parents=True, exist_ok=True)
+    if target.exists() and target.stat().st_size > 0:
+        try:
+            with target.open("r", encoding="utf-8") as f:
+                config = cast(dict[str, Any], yaml.safe_load(f) or {})
+        except yaml.YAMLError as e:
+            raise ValueError(f"Failed to parse config file {target}: {e}") from e
+    else:
+        config = {}
+
+    existing = config.get("secret_scan_exclude")
+    if not isinstance(existing, list):
+        existing = []
+    if path not in existing:
+        existing.append(path)
+    config["secret_scan_exclude"] = existing
+
+    with target.open("w", encoding="utf-8") as f:
+        yaml.safe_dump(_serialize_config(config), f, sort_keys=False)
+
+    log.info("Added %s to secret_scan_exclude in %s", path, target)
+    return target
+
+
 def apply_cli_overrides(
     config: dict,
     *,

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/gitutils.py

@@ -222,6 +222,25 @@ def _load_caiignore_patterns(repo_root: Path) -> list[str]:
     return patterns
 
 
+def append_to_caiignore(repo_root: Path, path: str) -> Path:
+    """Append ``path`` as a line to ``<repo>/.caiignore`` if not already present.
+
+    Idempotent; creates the file if missing. Returns the ignore-file path.
+    """
+    ignore_file = repo_root / ".caiignore"
+    lines: list[str] = []
+    if ignore_file.exists():
+        lines = ignore_file.read_text(encoding="utf-8").splitlines()
+
+    if path in (line.strip() for line in lines):
+        return ignore_file
+
+    lines.append(path)
+    ignore_file.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    log.info("Added %s to %s", path, ignore_file)
+    return ignore_file
+
+
 def git_diff_excluding(
     repo_root: Path,
     run_cmd: Callable[..., subprocess.CompletedProcess] = subprocess.run,

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/llm.py

@@ -337,18 +337,39 @@ class CommitMessageGenerator:
         """
         self._classification_counts = classify_changed_paths(paths)
 
-    def generate(
+    def _log_target(self) -> None:
+        """Log the active provider and model once, up front.
+
+        Call sites run this *before* starting the spinner so this routine
+        config noise does not interleave with the spinner's live frames —
+        interleaving would break the spinner line and make a single
+        generation look like two. The per-provider methods log the same
+        detail at DEBUG.
+        """
+        model = (self.config.get(self.default_model) or {}).get("model")
+        log.info("Using provider '%s' (model '%s').", self.default_model, model)
+
+    def send(self, content: str, system_prompt: str) -> str:
+        """Run the secret scan and dispatch a prebuilt request to the LLM.
+
+        This is the network-bound half of generation — the part worth
+        wrapping in a spinner. Prompt building (and its logging) happens
+        earlier in the matching ``build_*_request`` method.
+        """
+        return self._dispatch_generate(content=content, system_prompt=system_prompt)
+
+    def build_commit_request(
         self,
         git_diff: str,
         context: str | None = None,
         previous_message: str | None = None,
-    ) -> str:
-        """
-        Generate a commit message from a diff.
+    ) -> tuple[str, str]:
+        """Build the ``(content, system_prompt)`` pair for a commit message.
 
-        ``previous_message`` is used in amend mode so the model refines the
-        existing message instead of regenerating from scratch.
+        Split out from :meth:`generate` so prompt building runs before the
+        spinner starts. ``previous_message`` is used in amend mode.
         """
+        self._log_target()
         self.set_changed_files(paths_from_diff(git_diff))
         prompt = self._build_commit_prompt(previous_message=previous_message)
         log.debug("Commit system prompt preview: %r", prompt[:400])
@@ -359,15 +380,30 @@ class CommitMessageGenerator:
                 f"{git_diff}\n\n"
                 f"--- Additional context from the author ---\n{context}"
             )
+        return content, prompt
 
-        return self._dispatch_generate(content=content, system_prompt=prompt)
-
-    def summarize_commit_history(
-        self, commit_messages: str, context: str | None = None
+    def generate(
+        self,
+        git_diff: str,
+        context: str | None = None,
+        previous_message: str | None = None,
     ) -> str:
         """
-        Summarize multiple commit messages into one high-level commit message.
+        Generate a commit message from a diff.
+
+        ``previous_message`` is used in amend mode so the model refines the
+        existing message instead of regenerating from scratch.
         """
+        content, prompt = self.build_commit_request(
+            git_diff, context=context, previous_message=previous_message
+        )
+        return self.send(content, prompt)
+
+    def build_squash_request(
+        self, commit_messages: str, context: str | None = None
+    ) -> tuple[str, str]:
+        """Build the ``(content, system_prompt)`` pair for a squash summary."""
+        self._log_target()
         prompt = self._build_squash_prompt()
         log.debug("Squash system prompt preview: %r", prompt[:400])
 
@@ -377,19 +413,25 @@ class CommitMessageGenerator:
                 f"{commit_messages}\n\n"
                 f"--- Additional context from the author ---\n{context}"
             )
+        return content, prompt
 
-        return self._dispatch_generate(content=content, system_prompt=prompt)
+    def summarize_commit_history(
+        self, commit_messages: str, context: str | None = None
+    ) -> str:
+        """
+        Summarize multiple commit messages into one high-level commit message.
+        """
+        content, prompt = self.build_squash_request(commit_messages, context=context)
+        return self.send(content, prompt)
 
-    def generate_pr_description(
+    def build_pr_request(
         self,
         commit_log: str,
         changed_files: str,
         context: str | None = None,
-    ) -> str:
-        """
-        Generate a Markdown Pull Request description from the commit log and
-        changed-files list of a feature branch.
-        """
+    ) -> tuple[str, str]:
+        """Build the ``(content, system_prompt)`` pair for a PR description."""
+        self._log_target()
         self.set_changed_files(changed_files.splitlines())
         prompt = self._build_pr_prompt()
         log.debug("PR system prompt preview: %r", prompt[:400])
@@ -402,14 +444,27 @@ class CommitMessageGenerator:
             changed_files.strip() or "(no files)",
         ]
         content = "\n".join(sections)
-
         if context:
             content = (
                 f"{content}\n\n"
                 f"--- Additional context from the author ---\n{context}"
             )
+        return content, prompt
 
-        return self._dispatch_generate(content=content, system_prompt=prompt)
+    def generate_pr_description(
+        self,
+        commit_log: str,
+        changed_files: str,
+        context: str | None = None,
+    ) -> str:
+        """
+        Generate a Markdown Pull Request description from the commit log and
+        changed-files list of a feature branch.
+        """
+        content, prompt = self.build_pr_request(
+            commit_log, changed_files, context=context
+        )
+        return self.send(content, prompt)
 
     def _emoji_instruction(self) -> str:
         """
@@ -686,9 +741,24 @@ class CommitMessageGenerator:
         if self.default_model in TOKENLESS_PROVIDERS:
             return
 
-        from git_cai_cli.core.secrets import SecretLeakError, scan_for_secrets
+        from git_cai_cli.core.secrets import (
+            SecretLeakError,
+            drop_excluded,
+            scan_for_secrets,
+        )
 
         findings = scan_for_secrets(content)
+
+        # Files listed in `secret_scan_exclude` stay part of the payload but
+        # are exempt from the scan (false alarms the user already vetted).
+        # Matched with gitignore semantics for parity with `.caiignore`.
+        excludes = self.config.get("secret_scan_exclude") or []
+        if findings and excludes:
+            import pathspec
+
+            spec = pathspec.GitIgnoreSpec.from_lines(excludes)
+            findings = drop_excluded(findings, spec.match_file)
+
         if findings:
             raise SecretLeakError(findings)
 
@@ -714,7 +784,7 @@ class CommitMessageGenerator:
         if self.default_model not in model_dispatch:
             raise ValueError(f"Unknown model type: '{self.default_model}'")
 
-        log.info("Using provider '%s' for generation.", self.default_model)
+        log.debug("Using provider '%s' for generation.", self.default_model)
 
         return model_dispatch[self.default_model](
             content, system_prompt_override=system_prompt
@@ -751,7 +821,7 @@ class CommitMessageGenerator:
             or anthropic_cfg.get("max_tokens", 32768)
         )
 
-        log.info("Using anthropic model '%s'.", model)
+        log.debug("Using anthropic model '%s'.", model)
 
         # Anthropic Messages API expects system prompt via the top-level "system" field.
         messages = [{"role": "user", "content": content}]
@@ -817,7 +887,7 @@ class CommitMessageGenerator:
         model = self.config["gemini"]["model"]
         temperature = self.config["gemini"]["temperature"]
 
-        log.info("Using gemini model '%s'.", model)
+        log.debug("Using gemini model '%s'.", model)
 
         url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent"
 
@@ -874,7 +944,7 @@ class CommitMessageGenerator:
         model = self.config["groq"]["model"]
         temperature = self.config["groq"]["temperature"]
 
-        log.info("Using groq model '%s'.", model)
+        log.debug("Using groq model '%s'.", model)
 
         messages = []
 
@@ -934,7 +1004,7 @@ class CommitMessageGenerator:
         model = self.config["mistral"]["model"]
         temperature = self.config["mistral"]["temperature"]
 
-        log.info("Using mistral model '%s'.", model)
+        log.debug("Using mistral model '%s'.", model)
 
         messages = []
 
@@ -1119,7 +1189,7 @@ class CommitMessageGenerator:
         model = self.config["ollama"]["model"]
         temperature = self.config["ollama"]["temperature"]
 
-        log.info("Using ollama model '%s'.", model)
+        log.debug("Using ollama model '%s'.", model)
 
         url = f"{self._ollama_base_url()}/api/chat"
 
@@ -1214,7 +1284,7 @@ class CommitMessageGenerator:
             else self.config["openai"]["temperature"]
         )
 
-        log.info("Using %s model '%s'.", provider_name, model)
+        log.debug("Using %s model '%s'.", provider_name, model)
 
         messages = []
 
@@ -1265,7 +1335,7 @@ class CommitMessageGenerator:
         model = self.config["xai"]["model"]
         temperature = self.config["xai"]["temperature"]
 
-        log.info("Using xai model '%s'.", model)
+        log.debug("Using xai model '%s'.", model)
 
         messages = []
 

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/pr.py

@@ -150,14 +150,16 @@ def run_pr(
     generator.kind = "pr"
     generator.repo = repo_name_from_root(repo_root)
     generator.allow_secrets = allow_secrets
+    content, system_prompt = generator.build_pr_request(
+        commit_log, changed_files, context=context
+    )
     try:
         try:
             with Spinner("Generating PR description"):
                 description = _validate_llm_call(
-                    generator.generate_pr_description,
-                    commit_log,
-                    changed_files,
-                    context=context,
+                    generator.send,
+                    content,
+                    system_prompt,
                     token=token,
                     requires_token=provider not in TOKENLESS_PROVIDERS,
                 )

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/secrets.py

@@ -9,7 +9,7 @@ ceiling. Swap in gitleaks/detect-secrets only if the FP rate becomes a problem.
 """
 
 import re
-from typing import NamedTuple
+from typing import Callable, NamedTuple
 
 
 class Finding(NamedTuple):
@@ -144,6 +144,18 @@ def scan_for_secrets(text: str) -> list[Finding]:
     return findings
 
 
+def drop_excluded(
+    findings: list[Finding], is_excluded: Callable[[str], bool]
+) -> list[Finding]:
+    """Drop findings whose file path is excluded from secret scanning.
+
+    ``is_excluded`` is a predicate over a path (the caller supplies the
+    matching semantics — see ``secret_scan_exclude``). Findings with no path
+    (``path is None``) are unattributable and never excluded.
+    """
+    return [f for f in findings if f.path is None or not is_excluded(f.path)]
+
+
 def format_findings(findings: list[Finding]) -> str:
     """Render findings as a human-readable, multi-line warning block."""
     lines = ["⚠️  Potential secret(s) detected in the content to be sent:"]

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/squash.py

@@ -308,11 +308,13 @@ def squash_branch(
             start = time.perf_counter() if measure else None
 
             generator.kind = "commit"
+            content, system_prompt = generator.build_commit_request(diff)
             try:
                 with Spinner("Generating commit message for staged changes"):
                     msg = _validate_llm_call(
-                        generator.generate,
-                        diff,
+                        generator.send,
+                        content,
+                        system_prompt,
                         token=token,
                         requires_token=provider not in TOKENLESS_PROVIDERS,
                     )
@@ -395,12 +397,15 @@ def squash_branch(
         start = time.perf_counter() if measure else None
 
         generator.kind = "squash"
+        content, system_prompt = generator.build_squash_request(
+            commit_log, context=context
+        )
         try:
             with Spinner("Summarizing commit history"):
                 summary_message = _validate_llm_call(
-                    generator.summarize_commit_history,
-                    commit_log,
-                    context=context,
+                    generator.send,
+                    content,
+                    system_prompt,
                     token=token,
                     requires_token=provider not in TOKENLESS_PROVIDERS,
                 )

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/core/validate.py

@@ -73,10 +73,11 @@ def _validate_config_keys(config: dict[str, Any], reference: dict[str, Any]) ->
         "stats_db_path",
         "signoff",
         "secret_scan",
+        "secret_scan_exclude",
     }
     # Internal escape-hatch keys: accepted if a user sets them, but never
     # reported as "missing" — they aren't part of the documented surface.
-    internal_only_keys = {"stats_db_path"}
+    internal_only_keys = {"stats_db_path", "secret_scan_exclude"}
     allowed_provider_keys = set(reference.keys()) - allowed_global_keys
 
     config_keys = set(config.keys())

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli/main.py

@@ -63,6 +63,50 @@ def _log_stats_state(config: dict) -> None:
     stats_module.log_state(config)
 
 
+def _route_false_alarm(findings: list, repo_root: Path | None) -> None:
+    """After a confirmed false alarm, offer to remember each flagged file.
+
+    For each distinct flagged path, prompt whether to add it to ``.caiignore``
+    (drop the file from git-cai), to ``secret_scan_exclude`` in the active
+    config (keep the file but skip its scan), or skip (remember nothing).
+    Findings without a path are unattributable and skipped.
+    """
+    from git_cai_cli.core.config import add_to_secret_scan_exclude
+    from git_cai_cli.core.gitutils import append_to_caiignore
+
+    seen: set[str] = set()
+    for finding in findings:
+        path = finding.path
+        if not path or path in seen:
+            continue
+        seen.add(path)
+
+        typer.echo(f"\nFalse alarm for: {path}", err=True)
+        typer.echo("How should git-cai remember this file?", err=True)
+        typer.echo(
+            "  1) .caiignore — drop the file from git-cai entirely "
+            "(it is never sent to the LLM again)",
+            err=True,
+        )
+        typer.echo(
+            "  2) config — keep sending the file, but skip its secret scan "
+            "from now on (added to secret_scan_exclude)",
+            err=True,
+        )
+        typer.echo("  3) skip — send it this once; remember nothing", err=True)
+        choice = typer.prompt("Choose", default="3").strip()
+
+        if choice == "1":
+            if repo_root is None:
+                typer.echo("Not in a git repo; cannot write .caiignore.", err=True)
+                continue
+            target = append_to_caiignore(repo_root, path)
+            typer.echo(f"Added {path} to {target}", err=True)
+        elif choice == "2":
+            target = add_to_secret_scan_exclude(path)
+            typer.echo(f"Added {path} to secret_scan_exclude in {target}", err=True)
+
+
 def run(
     *,
     mode: Mode,
@@ -272,15 +316,19 @@ def run(
     spinner_text = (
         "Regenerating commit message" if is_amend else "Generating commit message"
     )
+    # Build the prompt (and emit its config logging) before the spinner starts,
+    # so that routine info does not interleave with the live spinner frames.
+    content, system_prompt = generator.build_commit_request(
+        diff, context=context, previous_message=previous_message
+    )
     try:
         while True:
             try:
                 with Spinner(spinner_text):
                     commit_message = _validate_llm_call(
-                        generator.generate,
-                        diff,
-                        context=context,
-                        previous_message=previous_message,
+                        generator.send,
+                        content,
+                        system_prompt,
                         token=token,
                         requires_token=provider not in TOKENLESS_PROVIDERS,
                     )
@@ -299,6 +347,7 @@ def run(
                 ):
                     typer.echo("Aborted. Nothing was sent.", err=True)
                     raise typer.Exit(code=1)
+                _route_false_alarm(leak.findings, repo_root)
                 generator.allow_secrets = True
             except ValueError as e:
                 typer.echo(f"Error: {e}", err=True)

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-cai-cli
-Version: 0.15.1
+Version: 0.15.2
 Summary: Use LLM to create git commit messages
 Author-email: Thorsten Foltz <thorsten.foltz@live.com>
 License-Expression: MIT

{git_cai_cli-0.15.1 → git_cai_cli-0.15.2}/src/git_cai_cli.egg-info/SOURCES.txt

@@ -42,6 +42,8 @@ src/git_cai_cli.egg-info/SOURCES.txt
 src/git_cai_cli.egg-info/dependency_links.txt
 src/git_cai_cli.egg-info/entry_points.txt
 src/git_cai_cli.egg-info/requires.txt
+src/git_cai_cli.egg-info/scm_file_list.json
+src/git_cai_cli.egg-info/scm_version.json
 src/git_cai_cli.egg-info/top_level.txt
 src/git_cai_cli/cli/__init__.py
 src/git_cai_cli/cli/cli.py