gitpro 0.3.1__py3-none-any.whl

gitpro/render.py

@@ -0,0 +1,474 @@
+"""Pure text rendering: config objects in, file contents out. No I/O."""
+from __future__ import annotations
+
+import re
+import shlex
+from pathlib import Path
+from typing import Callable
+
+from .config import Default, Identity, check, signs
+
+TOOL = "gitpro"
+# Also recognise what earlier versions wrote (git-identities, git_identities.py), so existing setups migrate.
+_TOOLS = r"(?:gitpro|git-identities|git_identities\.py)"
+
+MARKER = f"# Generated by {TOOL}"
+HEADER = f"{MARKER} -- edit the TOML config and re-run; do not edit this file."
+MANIFEST = "# managed: "
+BLOCK_BEGIN = f"# BEGIN {TOOL}"
+BLOCK_END = f"# END {TOOL}"
+INDENT = "    "  # gitconfig keys; git itself writes a tab
+
+SECTION_RE = re.compile(r"^[A-Za-z0-9.-]+$")
+KEY_RE = re.compile(r"^[A-Za-z][A-Za-z0-9-]*$")
+_GENERATED_RE = re.compile(rf"# Generated by {_TOOLS}(?:\s|$)")
+_BLOCK_RE = re.compile(rf"^# BEGIN {_TOOLS}[^\n]*\n.*?^# END {_TOOLS}[^\n]*(?:\n|\Z)", re.M | re.S)
+_MARK_RE = re.compile(rf"^# (BEGIN|END) {_TOOLS}", re.M)
+
+Expand = Callable[[str], Path]
+
+
+# ---------------------------------------------------------------- gitconfig syntax
+
+def gval(v: object) -> str:
+    if isinstance(v, bool):
+        return "true" if v else "false"
+    return '"' + str(v).replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+
+def section(name: str, sub: str | None = None) -> str:
+    return f"[{name}]" if sub is None else f"[{name} {gval(sub)}]"
+
+
+def _kv_lines(body: dict, where: str) -> list[str]:
+    out = []
+    for k, v in body.items():
+        check(KEY_RE.match(k), f"{where}: bad git key {k!r}")
+        for item in v if isinstance(v, list) else [v]:
+            check(not isinstance(item, (dict, list)), f"{where}.{k}: nested too deep")
+            out.append(f"{INDENT}{k} = {gval(item)}")
+    return out
+
+
+def git_lines(sections: dict, where: str) -> list[str]:
+    """{section: {key: val, subsection: {key: val}}} -> gitconfig lines."""
+    out = []
+    for sec, body in sections.items():
+        check(isinstance(body, dict) and SECTION_RE.match(sec), f"{where}: bad git section {sec!r}")
+        flat = {k: v for k, v in body.items() if not isinstance(v, dict)}
+        if flat:
+            out += [section(sec), *_kv_lines(flat, f"{where}.{sec}")]
+        for sub, sbody in body.items():
+            if isinstance(sbody, dict):
+                out += [section(sec, sub), *_kv_lines(sbody, f"{where}.{sec}.{sub}")]
+    return out
+
+
+def merge(a: dict, b: dict) -> dict:
+    out = dict(a)
+    for k, v in b.items():
+        out[k] = merge(out[k], v) if isinstance(v, dict) and isinstance(out.get(k), dict) else v
+    return out
+
+
+# ---------------------------------------------------------------- helpers
+
+def pub_path(key: Path) -> Path:
+    return key.with_name(key.name + ".pub")
+
+
+def _shell_path(p: str) -> str:
+    return "~/" + shlex.quote(p[2:]) if p.startswith("~/") else shlex.quote(p)
+
+
+def _owner_prefixes(i: Identity) -> list[str]:
+    return [o.strip("/") + "/" for o in i.owners] or [""]
+
+
+def _scp_patterns(user: str, host: str, owner: str) -> list[str]:
+    # In git's wildmatch "**" crosses "/" only as a whole path component, so "host:**" would stop at the
+    # first "/": an owner-less identity needs "host:*" (one segment) and "host:*/**" (nested).
+    return [f"{user}@{host}:{owner}**"] if owner else [f"{user}@{host}:*", f"{user}@{host}:*/**"]
+
+
+def url_patterns(i: Identity) -> list[str]:
+    """The includeIf hasconfig:remote.*.url patterns for i (resolve.match_url uses the same list)."""
+    pats = []
+    for o in _owner_prefixes(i):
+        for h in [i.host] + ([i.ssh_alias] if i.ssh_alias else []):
+            pats += [*_scp_patterns(i.ssh_user, h, o), f"ssh://{i.ssh_user}@{h}/{o}**"]
+        if i.ssh_port:
+            pats.append(f"ssh://{i.ssh_user}@{i.host}:{i.ssh_port}/{o}**")
+        pats.append(f"https://{i.host}/{o}**")
+    return list(dict.fromkeys(pats))
+
+
+def _sign_cfg(key: Path) -> dict:
+    return {"gpg": {"format": "ssh"}, "user": {"signingkey": str(pub_path(key))},
+            "commit": {"gpgsign": True}, "tag": {"gpgsign": True}}
+
+
+# ---------------------------------------------------------------- files
+
+def managed_gitconfig(d: Default, ids: list[Identity], expand: Expand,
+                      signers_file: str | None, manifest: list[str]) -> str:
+    lines = [HEADER, *(MANIFEST + m for m in manifest), "# Later includeIf blocks win when several match.", ""]
+    lines += git_lines(default_settings(d, expand, signers_file), "default.git")
+    for i in ids:
+        lines += ["", f"# {i.id}: {i.host} {' '.join(i.owners) or '(all owners)'}"]
+        for p in url_patterns(i):
+            lines += [section("includeIf", f"hasconfig:remote.*.url:{p}"), f"{INDENT}path = {gval(i.file)}"]
+        if i.ssh_alias and i.rewrite:
+            # Send this identity's URLs through the alias, whose ssh Host offers only its key.
+            for o in _owner_prefixes(i):
+                if "*" in o:
+                    continue
+                srcs = [f"{i.ssh_user}@{i.host}:{o}", f"ssh://{i.ssh_user}@{i.host}/{o}"]
+                if i.rewrite_https:
+                    srcs.append(f"https://{i.host}/{o}")
+                lines.append(section("url", f"{i.ssh_user}@{i.ssh_alias}:{o}"))
+                lines += [f"{INDENT}insteadOf = {gval(s)}" for s in srcs]
+    return "\n".join(lines) + "\n"
+
+
+def default_settings(d: Default, expand: Expand, signers_file: str | None = None) -> dict:
+    """The git settings the managed file gives every repo: gitpro's base with [default.git] over it.
+    resolve reads the same dict, so `why` expects exactly what apply writes."""
+    # Never fall back to a guessed user@hostname identity.
+    base: dict = {"user": {"useConfigOnly": True}}
+    if d.name:
+        base["user"].update(name=d.name, email=d.email)
+    if d.sign:
+        base = merge(base, _sign_cfg(expand(d.ssh_key)))
+    if signers_file:
+        base = merge(base, {"gpg": {"ssh": {"allowedSignersFile": signers_file}}})
+    return merge(base, d.git)
+
+
+def identity_settings(i: Identity, d: Default, expand: Expand) -> dict:
+    """The git settings of i's generated file: gitpro's base with [identity.git] over it."""
+    base: dict = {"user": {"name": i.name, "email": i.email}}
+    if i.ssh_key:
+        base["core"] = {"sshCommand": f"ssh -i {_shell_path(i.ssh_key)} -o IdentitiesOnly=yes"}
+    if signs(i, d):
+        base = merge(base, _sign_cfg(expand(i.ssh_key or d.ssh_key)))
+    elif i.sign is False:
+        base = merge(base, {"commit": {"gpgsign": False}, "tag": {"gpgsign": False}})
+    return merge(base, i.git)
+
+
+def identity_gitconfig(i: Identity, d: Default, expand: Expand) -> str:
+    return "\n".join([HEADER, *git_lines(identity_settings(i, d, expand), f"identity {i.id!r}.git")]) + "\n"
+
+
+def _ssh_block(name: str, key: str, host: str | None = None, user: str | None = None,
+               port: int | None = None) -> list[str]:
+    lines = [f"Host {name}"]
+    if host:
+        lines.append(f"    HostName {host}")
+    if user:
+        lines.append(f"    User {user}")
+    if port:
+        lines.append(f"    Port {port}")
+    return lines + [f"    IdentityFile {key}", "    IdentitiesOnly yes", ""]
+
+
+def ssh_config(d: Default, ids: list[Identity]) -> str:
+    lines = [HEADER, ""]
+    for h in d.ssh_hosts:
+        lines += _ssh_block(h, d.ssh_key)
+    for i in ids:
+        if i.ssh_alias:
+            lines += _ssh_block(i.ssh_alias, i.ssh_key, i.host, i.ssh_user, i.ssh_port)
+    return "\n".join(lines)
+
+
+def allowed_signers(entries: list[tuple[str, str]]) -> str:
+    return "\n".join([HEADER, *(f'{email} namespaces="git" {pub}' for email, pub in entries)]) + "\n"
+
+
+# ---------------------------------------------------------------- generated files, marked blocks in user files
+
+def is_generated(text: str) -> bool:
+    """The marker on line 1, or on line 2 after a #! line (hook scripts)."""
+    if _GENERATED_RE.match(text):
+        return True
+    first, nl, rest = text.partition("\n")
+    return bool(nl) and first.startswith("#!") and bool(_GENERATED_RE.match(rest))
+
+
+def has_block(text: str) -> bool:
+    return bool(_MARK_RE.search(text))
+
+
+def without_block(text: str) -> str:
+    return _BLOCK_RE.sub("", text)
+
+
+def _check_markers(text: str, where: str) -> None:
+    # An orphaned marker would make without_block swallow the hand-written text between two blocks.
+    marks = _MARK_RE.findall(text)
+    check(marks == ["BEGIN", "END"] * (len(marks) // 2),
+          f"{where}: unpaired '{BLOCK_BEGIN}' / '{BLOCK_END}' marker; fix it by hand")
+
+
+def with_block(text: str, body: str, first: bool, where: str) -> str:
+    """Exactly one marked block at the start or end of text; re-running is a no-op."""
+    _check_markers(text, where)
+    block = f"{BLOCK_BEGIN} -- keep {'first' if first else 'last'}\n{body}\n{BLOCK_END}\n"
+    rest = without_block(text)
+    if first:
+        rest = rest.lstrip("\n")
+        return block + ("\n" + rest if rest else "")
+    rest = rest.rstrip("\n")
+    return (rest + "\n\n" if rest else "") + block
+
+
+def strip_block(text: str, where: str) -> str:
+    """text without the marked block and the blank lines with_block added around it."""
+    _check_markers(text, where)
+    rest = without_block(text).strip("\n")
+    return rest + "\n" if rest else ""
+
+
+def manifest_of(text: str) -> list[str]:
+    return [line[len(MANIFEST):] for line in text.splitlines() if line.startswith(MANIFEST)]
+
+
+# ---------------------------------------------------------------- guard hooks (06)
+
+GUARD_HOOKS = ("pre-commit", "pre-push", "commit-msg")   # run `gitpro guard check <name>`, then chain
+# githooks(5) names a repo or a tool plausibly installs; with a global core.hooksPath git runs only the
+# hooks in that dir, so each one forwards to the repo's own hook and to chain_to.
+STUB_HOOKS = ("applypatch-msg", "pre-applypatch", "post-applypatch", "prepare-commit-msg", "post-commit",
+              "pre-merge-commit", "pre-rebase", "post-checkout", "post-merge", "pre-receive", "update",
+              "proc-receive", "post-receive", "post-update", "pre-auto-gc", "post-rewrite",
+              "sendemail-validate")
+HOOK_NAMES = GUARD_HOOKS + STUB_HOOKS
+# push-to-checkout: git skips its built-in receive.denyCurrentBranch=updateInstead deploy whenever the hook
+# exists, so a stub would stop pushes from updating a checked-out tree.
+NOT_FORWARDED = ("push-to-checkout", "reference-transaction", "post-index-change", "fsmonitor-watchman", "p4-*")
+STDIN_HOOKS = ("pre-push", "pre-receive", "proc-receive", "post-receive", "post-rewrite")
+LFS_HOOKS = ("pre-push", "post-checkout", "post-commit", "post-merge")   # what `git lfs install` writes
+MAX_HOOK_DEPTH = 8   # nested hook runs before a script assumes a loop and stops forwarding
+GUARD_INCLUDE_COMMENT = "# guard hooks: gitpro guard install, or [guard] hooks = true"
+
+_HOOK_HEAD = """\
+#!/bin/sh
+{header}
+# gitpro {what}: {name}. Skip gitpro once: GITPRO_SKIP=1 git ...  (git --no-verify skips every hook)
+# {after}
+
+depth=${{GITPRO_HOOK_DEPTH:-0}}
+case $depth in ''|*[!0-9]*) depth=0 ;; esac
+if [ "$depth" -ge {max_depth} ]; then
+  echo "⚠ gitpro guard: hooks nested $depth deep (a hook loop?); not running {name} hooks" >&2
+  exit 0
+fi
+GITPRO_HOOK_DEPTH=$((depth + 1)); export GITPRO_HOOK_DEPTH
+# An exported CDPATH makes cd search it (and print the dir) for a relative path like .git.
+unset CDPATH
+
+own_dir=$(cd -P -- "$(dirname -- "$0")" >/dev/null 2>&1 && pwd)
+# --git-common-dir may be relative to the cwd (.git); cd -P makes it absolute on every git (no
+# --path-format, which git < 2.31 lacks). ./ keeps cd from searching CDPATH even if it were set.
+common=$(git rev-parse --git-common-dir 2>/dev/null) || common=""
+case $common in ''|/*) ;; *) common="./$common" ;; esac
+if [ -n "$common" ]; then common=$(cd -P -- "$common" >/dev/null 2>&1 && pwd) || common=""; fi
+repo_hook="$common/hooks/{name}"
+run_repo=""
+# Never run a hook from gitpro's own dir, nor one that is (a link to) this script: that would loop.
+# test -ef is not POSIX but dash, bash, zsh, ksh and busybox sh all have it.
+if [ -n "$common" ] && [ -x "$repo_hook" ] && [ "$(cd -P -- "$(dirname -- "$repo_hook")" >/dev/null 2>&1 && pwd)" != "$own_dir" ] \
+   && ! [ "$repo_hook" -ef "$own_dir/{name}" ]; then
+  run_repo=1
+fi
+chain={chain}
+run_chain=""
+if [ -n "$chain" ] && [ -x "$chain/{name}" ] && [ "$(cd -P -- "$chain" >/dev/null 2>&1 && pwd)" != "$own_dir" ] \
+   && ! [ "$chain/{name}" -ef "$own_dir/{name}" ]; then
+  run_chain=1
+fi
+"""
+
+_STDIN_ALWAYS = """
+tmp=$(mktemp "${TMPDIR:-/tmp}/gitpro-hook.XXXXXX" 2>/dev/null) || tmp=""
+if [ -n "$tmp" ]; then trap 'rm -f "$tmp"' EXIT; trap 'exit 129' HUP; trap 'exit 130' INT; trap 'exit 143' TERM
+  cat >"$tmp"; fi
+in_tmp() { if [ -n "$tmp" ]; then "$@" <"$tmp"; else "$@"; fi; }
+"""
+
+# A stub keeps stdin only when two hooks need it; one hook reads git's stdin directly (proc-receive talks
+# to git over stdin/stdout, so it must never be buffered).
+_STDIN_SHARED = """
+tmp=""
+if [ -n "$run_repo" ] && [ -n "$run_chain" ]; then
+  tmp=$(mktemp "${TMPDIR:-/tmp}/gitpro-hook.XXXXXX" 2>/dev/null) || tmp=""
+  if [ -n "$tmp" ]; then trap 'rm -f "$tmp"' EXIT; trap 'exit 129' HUP; trap 'exit 130' INT; trap 'exit 143' TERM
+    cat >"$tmp"; fi
+fi
+in_tmp() { if [ -n "$tmp" ]; then "$@" <"$tmp"; else "$@"; fi; }
+"""
+
+_NO_STDIN = """
+in_tmp() { "$@"; }
+"""
+
+# The fail-open warning prints once per git command: pre-commit clears $once on every run and notes git's
+# pid ($PPID) in it when it warns; commit-msg of the same git process then stays quiet and removes the
+# file. GITPRO_GIT_PID / GITPRO_WARNED_FILE let `guard check` do the same for its own warnings. A file
+# left by an aborted commit is cleared by the next pre-commit; gitpro guard uninstall does not visit repos.
+_CHECK = """
+if [ -z "${{GITPRO_SKIP:-}}" ]; then
+  gp=""
+  if command -v gitpro >/dev/null 2>&1; then gp=gitpro
+  elif [ -x "$HOME/.local/bin/gitpro" ]; then gp="$HOME/.local/bin/gitpro"
+  elif [ -x {gitpro_bin} ]; then gp={gitpro_bin}
+  fi
+  if [ -n "$gp" ]; then
+    once=""; if [ -n "$common" ]; then once="$common/gitpro-guard-warned"; fi
+    GITPRO_GIT_PID=$PPID; GITPRO_WARNED_FILE=$once; export GITPRO_GIT_PID GITPRO_WARNED_FILE
+{clear}    rc=0
+{run}
+    if [ "$rc" -eq 3 ]; then exit 1; fi
+    if [ "$rc" -ne 0 ]; then
+{warn}
+    fi
+{consume}  fi
+fi
+"""
+_RUN_TIMEOUT = """\
+    if command -v timeout >/dev/null 2>&1; then in_tmp {timeout} "$gp" guard check {name} "$@" || rc=$?
+    else in_tmp "$gp" guard check {name} "$@" || rc=$?
+    fi"""
+_RUN_PLAIN = """\
+    in_tmp "$gp" guard check {name} "$@" || rc=$?"""
+_CLEAR_ONCE = """\
+    if [ -n "$once" ] && [ -e "$once" ]; then rm -f "$once" 2>/dev/null; fi
+"""
+_WARN = """\
+      echo "⚠ gitpro guard: exited $rc; not blocking" >&2"""
+_WARN_FIRST = _WARN + """
+      if [ -n "$once" ]; then { echo "$PPID" >"$once"; } 2>/dev/null; fi"""
+_WARN_AGAIN = """\
+      if [ -z "$once" ] || [ "$(cat "$once" 2>/dev/null)" != "$PPID" ]; then
+        echo "⚠ gitpro guard: exited $rc; not blocking" >&2
+      fi"""
+
+# `git lfs install` writes .git/hooks/<name> calling `git lfs <name>`; under a global core.hooksPath those
+# files would not run, so the hook calls it unless the repo's own hook already does.
+_LFS = """
+if [ -n "$(git config filter.lfs.process 2>/dev/null)" ] && command -v git-lfs >/dev/null 2>&1; then
+  if [ ! -f "$repo_hook" ] || ! grep -q -e 'git lfs' -e 'git-lfs' "$repo_hook" 2>/dev/null; then
+    in_tmp git lfs {name} "$@" || exit $?
+  fi
+fi
+"""
+
+_TAIL = """
+if [ -n "$run_repo" ]; then in_tmp "$repo_hook" "$@" || exit $?; fi
+if [ -n "$run_chain" ]; then in_tmp "$chain/{name}" "$@" || exit $?; fi
+exit 0
+"""
+
+
+def _hook(name: str, chain_to: str | None, gitpro_bin: str | None, check_first: bool, timeout: str = "") -> str:
+    chain = shlex.quote(str(chain_to)) if chain_to else "''"
+    after = ("After the gitpro check, the repo's own hook runs (<common dir>/hooks/{n}), then the chain_to hook."
+             if check_first else "Runs the repo's own hook (<common dir>/hooks/{n}), then the chain_to hook.")
+    text = _HOOK_HEAD.format(header=HEADER, what="guard hook" if check_first else "pass-through hook",
+                             name=name, after=after.format(n=name), max_depth=MAX_HOOK_DEPTH, chain=chain)
+    if check_first and name == "pre-push":
+        text += _STDIN_ALWAYS
+    elif name in STDIN_HOOKS:
+        text += _STDIN_SHARED
+    else:
+        text += _NO_STDIN
+    if check_first:
+        run = (_RUN_TIMEOUT.format(timeout=timeout, name=name) if timeout else _RUN_PLAIN.format(name=name))
+        warn = {"pre-commit": _WARN_FIRST, "commit-msg": _WARN_AGAIN}.get(name, _WARN)
+        text += _CHECK.format(gitpro_bin=shlex.quote(str(gitpro_bin)) if gitpro_bin else "''", run=run,
+                              warn=warn, clear=_CLEAR_ONCE if name == "pre-commit" else "",
+                              consume=_CLEAR_ONCE if name == "commit-msg" else "")
+    if name in LFS_HOOKS:
+        text += _LFS.format(name=name)
+    return text + _TAIL.format(name=name)
+
+
+def hook_script(name: str, chain_to: str | None, gitpro_bin: str | None, timeout: str = "") -> str:
+    """The global chain script for pre-commit / pre-push / commit-msg: `gitpro guard check <name>` (only
+    exit 3 blocks; any other failure warns and continues), then the repo's own hook, then chain_to's.
+    timeout: a command prefix that bounds the check (`timeout --foreground 30`), "" for none."""
+    check(name in GUARD_HOOKS, f"not a guard hook: {name}")
+    return _hook(name, chain_to, gitpro_bin, True, timeout)
+
+
+def hook_stub(name: str, chain_to: str | None) -> str:
+    """The pass-through script for every other hook name: the repo's own hook, then chain_to's."""
+    check(name in STUB_HOOKS, f"not a pass-through hook: {name}")
+    return _hook(name, chain_to, None, False)
+
+
+def hooks_readme() -> str:
+    return (f"{HEADER}\n\n"
+            "These are gitpro's guard hooks, used by git for every repo through core.hooksPath. pre-commit and "
+            "pre-push refuse a commit or push whose committer email is not the identity the remote belongs "
+            "to; every hook then runs the repo's own hook (.git/hooks/<name>) and the [guard] chain_to hook. "
+            "If gitpro fails, the commit goes through. Skip gitpro's check once with GITPRO_SKIP=1 git ...; "
+            "git --no-verify skips every hook. Remove them with: gitpro guard uninstall. To warn once per "
+            "commit, pre-commit may leave <git dir>/gitpro-guard-warned behind (cleared on the next commit; "
+            "uninstall leaves it, it is safe to delete). Not forwarded "
+            f"(repos that need them keep their own core.hooksPath): {', '.join(NOT_FORWARDED)}.\n")
+
+
+def hooks_gitconfig(hooks_dir: Path) -> str:
+    """~/.gitconfig-gitpro-guard: the absolute core.hooksPath."""
+    return f"{HEADER}\n[core]\n{INDENT}hooksPath = {gval(str(hooks_dir))}\n"
+
+
+def _guard_section(include: str) -> list[str]:
+    return [GUARD_INCLUDE_COMMENT, "[include]", f"{INDENT}path = {gval(include)}"]
+
+
+def without_guard_include(text: str, include: str, paths: list[str]) -> str:
+    """The managed gitconfig without the guard include section and without `paths` in its manifest."""
+    lines = text.splitlines()
+    sec = _guard_section(include)
+    for n in range(len(lines) - len(sec), -1, -1):
+        if lines[n:n + len(sec)] == sec:
+            del lines[n:n + len(sec)]
+            if n and n <= len(lines) and not lines[n - 1].strip():
+                del lines[n - 1]
+    drop = {MANIFEST + p for p in paths}
+    lines = [ln for ln in lines if ln not in drop]
+    return "\n".join(lines) + "\n" if lines else ""
+
+
+def with_guard_include(text: str, include: str, paths: list[str]) -> str:
+    """The managed gitconfig with `paths` merged into its sorted manifest and the include of the guard
+    gitconfig as its last section. Applying it twice changes nothing."""
+    lines = without_guard_include(text, include, paths).rstrip("\n").splitlines()
+    idx = [n for n, ln in enumerate(lines) if ln.startswith(MANIFEST)]
+    entries = sorted(set(manifest_of("\n".join(lines))) | set(paths))
+    at = idx[0] if idx else 1
+    lines = [ln for ln in lines if not ln.startswith(MANIFEST)]
+    lines[at:at] = [MANIFEST + p for p in entries]
+    return "\n".join(lines + [""] + _guard_section(include)) + "\n"
+
+
+def guard_block(name: str) -> str:
+    """The repo-mode managed block for a hand-written hook (fails open; only exit 3 refuses)."""
+    if name == "pre-push":
+        body = ("if [ -z \"${GITPRO_SKIP:-}\" ] && command -v gitpro >/dev/null 2>&1; then\n"
+                "  rc=0; tmp=$(mktemp \"${TMPDIR:-/tmp}/gitpro-prepush.XXXXXX\" 2>/dev/null) || tmp=\"\"\n"
+                "  if [ -n \"$tmp\" ]; then cat >\"$tmp\"; gitpro guard check pre-push \"$@\" <\"$tmp\" || rc=$?; "
+                "exec <\"$tmp\"; rm -f \"$tmp\"\n"
+                "  else gitpro guard check pre-push \"$@\" || rc=$?; fi\n"
+                "  if [ \"$rc\" -eq 3 ]; then exit 1; fi\n"
+                "fi\n")
+    else:
+        body = ("if [ -z \"${GITPRO_SKIP:-}\" ] && command -v gitpro >/dev/null 2>&1; then\n"
+                f"  rc=0; gitpro guard check {name} \"$@\" || rc=$?\n"
+                "  if [ \"$rc\" -eq 3 ]; then exit 1; fi\n"
+                "fi\n")
+    return f"{BLOCK_BEGIN} -- keep first\n{body}{BLOCK_END}\n"