gitpro 0.3.2__tar.gz → 0.3.4__tar.gz

{gitpro-0.3.2 → gitpro-0.3.4}/PKG-INFO

@@ -1,10 +1,12 @@
 Metadata-Version: 2.5
 Name: gitpro
-Version: 0.3.2
+Version: 0.3.4
 Summary: Per-remote git identities (name, email, SSH key, commit signing) from one TOML file
-Project-URL: Homepage, https://github.com/Yantrakar/gitpro
+Project-URL: Homepage, https://gitpro.dev
+Project-URL: Source, https://github.com/Yantrakar/gitpro
 Project-URL: Documentation, https://github.com/Yantrakar/gitpro/blob/main/docs/guide.md
 Project-URL: Issues, https://github.com/Yantrakar/gitpro/issues
+Project-URL: VS Code extension, https://marketplace.visualstudio.com/items?itemName=yantrakar.gitpro
 Author: Yantrakar, Sandeep Shelke
 License-Expression: MIT
 License-File: LICENSE
@@ -22,10 +24,16 @@ Provides-Extra: tui
 Requires-Dist: textual>=0.80; extra == 'tui'
 Description-Content-Type: text/markdown
 
+<a href="https://gitpro.dev"><img src="https://gitpro.dev/icon.png" alt="gitpro" width="72" height="72"></a>
+
 # gitpro
 
+<!-- mcp-name: io.github.Yantrakar/gitpro -->
+
 **The right Git identity, SSH key and signature for every repository.**
 
+[gitpro.dev](https://gitpro.dev) · [PyPI](https://pypi.org/project/gitpro/) · [VS Code](https://marketplace.visualstudio.com/items?itemName=yantrakar.gitpro) · made by [Yantrakar](https://yantrakar.com)
+
 Work on a company repository, commit with your work email. Switch to a personal
 project, use your personal identity. Gitpro chooses by **remote URL**, not by
 where you happened to clone the repository.
@@ -98,6 +106,15 @@ optional operator-scoped preauthorization, and recoverable apply. MCP execution
 The detailed TOML, YAML and command examples live in the guide, not on the
 getting-started path.
 
+## Problems and questions
+
+Run `gitpro report` to draft an issue with the versions and a redacted
+`gitpro why`; it shows you the draft and opens nothing until you say yes.
+Or open an issue at [github.com/Yantrakar/gitpro/issues](https://github.com/Yantrakar/gitpro/issues).
+Report a security problem privately with `gitpro report --security`, as the
+[security policy](https://github.com/Yantrakar/gitpro/security/policy) describes,
+not in a public issue.
+
 ## License
 
 [MIT](LICENSE)

{gitpro-0.3.2 → gitpro-0.3.4}/README.md

@@ -1,7 +1,13 @@
+<a href="https://gitpro.dev"><img src="https://gitpro.dev/icon.png" alt="gitpro" width="72" height="72"></a>
+
 # gitpro
 
+<!-- mcp-name: io.github.Yantrakar/gitpro -->
+
 **The right Git identity, SSH key and signature for every repository.**
 
+[gitpro.dev](https://gitpro.dev) · [PyPI](https://pypi.org/project/gitpro/) · [VS Code](https://marketplace.visualstudio.com/items?itemName=yantrakar.gitpro) · made by [Yantrakar](https://yantrakar.com)
+
 Work on a company repository, commit with your work email. Switch to a personal
 project, use your personal identity. Gitpro chooses by **remote URL**, not by
 where you happened to clone the repository.
@@ -74,6 +80,15 @@ optional operator-scoped preauthorization, and recoverable apply. MCP execution
 The detailed TOML, YAML and command examples live in the guide, not on the
 getting-started path.
 
+## Problems and questions
+
+Run `gitpro report` to draft an issue with the versions and a redacted
+`gitpro why`; it shows you the draft and opens nothing until you say yes.
+Or open an issue at [github.com/Yantrakar/gitpro/issues](https://github.com/Yantrakar/gitpro/issues).
+Report a security problem privately with `gitpro report --security`, as the
+[security policy](https://github.com/Yantrakar/gitpro/security/policy) describes,
+not in a public issue.
+
 ## License
 
 [MIT](LICENSE)

{gitpro-0.3.2 → gitpro-0.3.4}/pyproject.toml

@@ -26,9 +26,11 @@ classifiers = [
 tui = ["textual>=0.80"]  # interactive scan --fix
 
 [project.urls]
-Homepage = "https://github.com/Yantrakar/gitpro"
+Homepage = "https://gitpro.dev"
+Source = "https://github.com/Yantrakar/gitpro"
 Documentation = "https://github.com/Yantrakar/gitpro/blob/main/docs/guide.md"
 Issues = "https://github.com/Yantrakar/gitpro/issues"
+"VS Code extension" = "https://marketplace.visualstudio.com/items?itemName=yantrakar.gitpro"
 
 [project.scripts]
 gitpro = "gitpro.hot:main"

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/__init__.py

@@ -1,4 +1,4 @@
 """Per-remote git identities generated from one TOML file (see cli.py)."""
 from __future__ import annotations
 
-__version__ = "0.3.2"
+__version__ = "0.3.4"

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/agents.py

@@ -1113,6 +1113,9 @@ class Decision:
     cause: str
     fix: str
     repo: str
+    why: str = ""                        # the denial record's reason code (not `reason`: that is the text below)
+    codes: Tuple[str, ...] = ()          # problem codes of the repo's report
+    action: str = ""                     # the git subcommand or program
 
     @property
     def reason(self) -> str:
@@ -1312,6 +1315,9 @@ def _judge_one(c: Call, rep, cfg, own: set, pushed_to: Optional[str] = None) ->
     top = str(rep.repo)
     what = _what(c)
     commits = c.prog == "git" and c.sub != "push"
+    codes = tuple(p.code for p in rep.problems)
+    action = c.sub if c.prog == "git" else c.prog
+    why = ("no_identity" if exp.email is None else "committer" if c_bad else "author" if a_bad else "problem")
     if exp.email is None:
         from .resolve import redact_url
         url = redact_url(next(iter(rep.effective.remotes.values()), None)) or top
@@ -1329,9 +1335,10 @@ def _judge_one(c: Call, rep, cfg, own: set, pushed_to: Optional[str] = None) ->
     if c_bad and c_src == "effective" and pushed_to and not triggers:
         # the repo's other problems were computed for this remote's identity; they would mislead here
         return Decision(headline, f"this repo's commits use {committer or '(no email)'} and {pushed_to} belongs "
-                                  f"to {exp.id or '[default]'}", f"gitpro why {shlex.quote(top)}", top)
+                                  f"to {exp.id or '[default]'}", f"gitpro why {shlex.quote(top)}", top,
+                        "pushed_to", codes, action)
     cause, fix = _cause(c, c_bad, c_src, committer, a_bad, a_src, author, rep, cfg, environ)
-    return Decision(headline, cause, fix, top)
+    return Decision(headline, cause, fix, top, why, codes, action)
 
 
 def _command_text(c: Call, limit: int = 200) -> str:
@@ -1447,6 +1454,7 @@ def _check(args: argparse.Namespace, text: str) -> int:
             sys.stdout.flush()
         print(msg, file=sys.stderr)
         return 0
+    _record_denial(args.agent, d)
     out, rc = adapter.deny(d)
     if out:
         sys.stdout.write(out + "\n")
@@ -1455,6 +1463,11 @@ def _check(args: argparse.Namespace, text: str) -> int:
     return rc
 
 
+def _record_denial(agent: str, d: Decision) -> None:
+    from . import incident              # lazy: stdlib only, but most checks never deny
+    incident.record_denial("agent-check", agent, d.action, d.why, d.codes)
+
+
 def _fail_open(func: Callable[[], int]) -> int:
     try:
         return func()
@@ -1463,9 +1476,18 @@ def _fail_open(func: Callable[[], int]) -> int:
     except _ArgError as e:
         return _fail_open_msg(str(e))
     except Exception as e:                 # fail open: never stop the agent
+        _record_crash(e)
         return _fail_open_msg(str(e) or type(e).__name__)
 
 
+def _record_crash(e: Exception) -> None:
+    try:
+        from . import incident
+        incident.record_crash("agent-check", e)
+    except Exception:                      # noqa: BLE001
+        pass
+
+
 def _fail_open_msg(msg: str) -> int:
     try:
         _warn(msg)

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/args.py

@@ -11,6 +11,8 @@ so both routes accept the same arguments without importing cli.
 from __future__ import annotations
 
 import argparse
+import os
+import re
 import shlex
 import subprocess
 import sys
@@ -64,6 +66,40 @@ def fail(msg: str, args: object) -> int:
     return 2
 
 
+_CMD_RE = re.compile(r"^[a-z][a-z0-9-]{0,30}$")
+
+
+def _command_path(args: object) -> str:
+    """The command words of parsed args ("forge similar"), or "gitpro"."""
+    words = [getattr(args, "command", None)]
+    for key, val in sorted(vars(args).items()) if hasattr(args, "__dict__") else []:
+        if key != "command" and key.endswith(("_command", "_action")):
+            words.append(val)
+    return " ".join(w for w in words if isinstance(w, str) and _CMD_RE.match(w)) or "gitpro"
+
+
+def _internal_error(args: object, exc: Exception) -> int:
+    """An unexpected exception: write the crash record, print two lines (the traceback only with
+    GITPRO_DEBUG=1), exit 2."""
+    from . import incident
+    command = _command_path(args)
+    incident.record_crash(command, exc)
+    name = type(exc).__qualname__
+    if not re.match(r"^[A-Za-z_][A-Za-z0-9_.]{0,80}$", name):
+        name = "Exception"
+    if os.environ.get("GITPRO_DEBUG") == "1":
+        import traceback
+        traceback.print_exception(type(exc), exc, exc.__traceback__)
+    if getattr(args, "json", False):
+        from . import jsonout
+        jsonout.error(getattr(args, "command", None) or "gitpro", f"internal error ({name})")
+    else:
+        print(f"✗ internal error ({name}): this is a gitpro bug", file=sys.stderr)
+        print("→ draft a report with: gitpro report --crash", file=sys.stderr)
+    return 2
+
+
+
 def guarded(func: Callable[[argparse.Namespace], int], args: argparse.Namespace) -> int:
     """func(args) with gitpro's error handling: ConfigError, CalledProcessError, OSError and UnicodeError
     become exit 2 through fail(); Ctrl-C / EOF exit 130."""
@@ -80,3 +116,5 @@ def guarded(func: Callable[[argparse.Namespace], int], args: argparse.Namespace)
     except (KeyboardInterrupt, EOFError):
         print(file=sys.stderr)
         return 130
+    except Exception as e:   # noqa: BLE001 - a bug in gitpro: record it, say so, exit 2
+        return _internal_error(args, e)

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/cli.py

@@ -14,6 +14,10 @@ first run on a new machine:
   gitpro keys              # public keys to register with each account
   gitpro scan              # every repo and the identity git uses there
 
+problems and questions:
+  gitpro report --print    # a redacted draft of a bug report; nothing is sent unless you say so
+  https://github.com/Yantrakar/gitpro/issues
+
 -- for developers (not part of --help) --
 CALLER_UMASK is the umask gitpro was started with. It is None until main() runs; main() saves it and
 then tightens the process umask to 077, so every file gitpro writes is private. A command that creates
@@ -58,6 +62,7 @@ EXTENSIONS = [
     "gitpro.operations",    # versioned agent preflight and scoped execution
     "gitpro.policy",        # 14: policy, team, check --policy
     "gitpro.prompt",        # 16: prompt
+    "gitpro.report",        # 19: report
     "gitpro.resolve",       # 01: why
     "gitpro.scanroots",     # 02: scan -c/--roots
     "gitpro.setup",         # guided configuration

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/config.py

@@ -24,7 +24,7 @@ _LABEL = r"[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?"
 HOST_RE = re.compile(rf"^{_LABEL}(?:\.{_LABEL})*$")
 ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
 USER_RE = ID_RE
-OWNER_RE = re.compile(r"^[A-Za-z0-9*][A-Za-z0-9._*-]*(?:/[A-Za-z0-9*][A-Za-z0-9._*-]*)*$")
+OWNER_RE = re.compile(r"^~?[A-Za-z0-9*][A-Za-z0-9._*-]*(?:/[A-Za-z0-9*][A-Za-z0-9._*-]*)*$")  # ~: SourceHut users
 PATH_RE = re.compile(r"^(?:~/|/)[A-Za-z0-9._/@+-]+$")
 EMAIL_RE = re.compile(r'^[^@\s<>"]+@[^@\s<>"]+$')
 CONTROL_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/discover.py

@@ -1228,7 +1228,7 @@ def render_toml(d: dict) -> str:
                 notes.append(f"{where}: already in config" + (f" (identity {o['config_id']})" if o.get("config_id") else ""))
                 continue
             if not OWNER_RE.match(o["owner"]):
-                notes.append(f"{where}: owners can hold only A-Z a-z 0-9 . _ - /; add it by hand if it is yours")
+                notes.append(f"{where}: owners can hold only A-Z a-z 0-9 . _ - / and a leading ~; add it by hand if it is yours")
                 continue
             rule = o.get("rule") or {}
             email = _top(o.get("emails"), _usable_email)[0]

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/guard.py

@@ -189,6 +189,7 @@ def _check(name: str, argv: List[str], stdin: Optional[str], repo: Optional[Path
         except KeyboardInterrupt:
             raise
         except Exception as e:   # noqa: BLE001
+            _record_crash(f"guard {name}", e)
             _warn(name, f"⚠ gitpro {spec}: {e}; not blocking")
             continue
         if rc == BLOCK:
@@ -227,8 +228,13 @@ def _where(exp) -> str:
     return url or "this repo"
 
 
-def _mismatch(ctx: Context, head: str, lines: List[str], skip: str) -> int:
+_RECORD = True        # False while `guard test` simulates a hook: nothing was denied
+
+
+def _mismatch(ctx: Context, head: str, lines: List[str], skip: str, reason: str = "problem") -> int:
     warn = ctx.cfg.guard.on_mismatch != "block"
+    if not warn and _RECORD:
+        _record_denial(ctx, reason)
     ctx.say(("⚠" if warn else "✗") + f" gitpro: {head}")
     for line in lines:
         ctx.say("  " + line)
@@ -238,6 +244,23 @@ def _mismatch(ctx: Context, head: str, lines: List[str], skip: str) -> int:
     return BLOCK
 
 
+def _record_crash(command: str, e: Exception) -> None:
+    try:
+        from . import incident
+        incident.record_crash(command, e)
+    except Exception:   # noqa: BLE001
+        pass
+
+
+def _record_denial(ctx: Context, reason: str) -> None:
+    try:
+        from . import incident
+        codes = tuple(p.code for p in getattr(ctx.report, "problems", ()) or ())
+        incident.record_denial("guard", None, ctx.hook, reason, codes)
+    except Exception:   # noqa: BLE001 - recording never changes the hook's answer
+        pass
+
+
 def _id_of(cfg, email: str) -> str:
     for i in cfg.identities:
         if _same(i.email, email):
@@ -269,14 +292,14 @@ def identity_commit(ctx: Context) -> int:
             lines = [f"cause: git resolves user.email to {ctx.committer_email} here",
                      f"fix:   {PROG} why {shlex.quote(str(ctx.repo))}"]
         return _mismatch(ctx, f"this commit would be committed as {ctx.committer_email} but {_where(exp)} "
-                              f"belongs to {_belongs(exp)}", lines, "commit")
+                              f"belongs to {_belongs(exp)}", lines, "commit", "committer")
     a = ctx.author_email
     if a and bad_author:
         lines = [f"cause: author is your {_id_of(ctx.cfg, a)} email",
                  f"fix:   unset GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL, or commit with "
                  f"--author={shlex.quote(f'{exp.name} <{exp.email}>')}"]
         return _mismatch(ctx, f"this commit would be authored as {a} but {_where(exp)} belongs to "
-                              f"{_belongs(exp)}", lines, "commit")
+                              f"{_belongs(exp)}", lines, "commit", "author")
     return 0
 
 
@@ -325,7 +348,7 @@ def identity_push(ctx: Context) -> int:
                      "then git commit --amend --no-edit on each)")
     head = (f"{n} commit{'s' * (n != 1)} to {_where(exp)} {'are' if n != 1 else 'is'} committed as {emails}; "
             f"this remote belongs to {exp.id or '[default]'} <{exp.email}>")
-    return _mismatch(ctx, head, lines, "push")
+    return _mismatch(ctx, head, lines, "push", "push")
 
 
 def _audit_available() -> bool:
@@ -598,10 +621,15 @@ def _check_strict(repo: Path) -> int:
     ctx = Context("pre-commit", top, (), "", cfg, report, _ident_email(top, "COMMITTER", os.environ),
                   _ident_email(top, "AUTHOR", os.environ), _say)
     refused = False
-    for spec in HOOKS["pre-commit"]:
-        fn = _entry(spec)
-        if fn is not None and fn(ctx) == BLOCK:
-            refused = True
+    global _RECORD
+    _RECORD = False
+    try:
+        for spec in HOOKS["pre-commit"]:
+            fn = _entry(spec)
+            if fn is not None and fn(ctx) == BLOCK:
+                refused = True
+    finally:
+        _RECORD = True
     return BLOCK if refused and cfg.guard.on_mismatch == "block" else 0
 
 

gitpro-0.3.4/src/gitpro/incident.py

@@ -0,0 +1,133 @@
+"""Incident records for `gitpro report` (spec 19, section 8): the last crash and the last denials.
+
+Stdlib only, so the hot hooks can import it. Best effort: a record that cannot be written is dropped
+silently, because a failing hook must behave exactly as it did before. A record holds fixed fields
+only: never an exception message, a local variable, an argument or a path outside the gitpro package.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import time
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Sequence
+
+from . import __version__
+
+PROG = "gitpro"
+CRASH = "last-crash.json"
+DENIALS = "denials.jsonl"
+KEEP = 20            # denials kept
+MAX_FRAMES = 30
+REASONS = ("committer", "author", "no_identity", "pushed_to", "problem", "push")
+SOURCES = ("guard", "agent-check")
+_TYPE_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_.]{0,80}$")
+_FUNC_RE = re.compile(r"^[A-Za-z_<][A-Za-z0-9_<>]{0,80}$")
+_COMMAND_RE = re.compile(r"^[a-z][a-z0-9 _.-]{0,60}$")
+_WORD_RE = re.compile(r"^[A-Za-z0-9_.-]{1,40}$")
+_CODE_RE = re.compile(r"^[a-z_]{1,32}$")
+
+
+def state_dir() -> Path:
+    """The same directory as undo.state_dir(): $XDG_STATE_HOME/gitpro or ~/.local/state/gitpro, 0700."""
+    base = os.environ.get("XDG_STATE_HOME") or str(Path.home() / ".local/state")
+    path = Path(base) / PROG
+    path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    return path
+
+
+def _now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%MZ", time.gmtime())
+
+
+def _write(path: Path, text: str) -> None:
+    """Atomically replace path with text, mode 0600."""
+    tmp = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(text)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            tmp.unlink()
+        except OSError:
+            pass
+        raise
+
+
+def _frames(tb: Any) -> "tuple[List[list], int]":
+    """(frames inside the gitpro package as [gitpro/<relpath>, line, func], count of the others)."""
+    import traceback
+    pkg = Path(__file__).resolve().parent
+    inside: List[list] = []
+    outside = 0
+    for frame, line in traceback.walk_tb(tb):
+        try:
+            rel = Path(frame.f_code.co_filename).resolve().relative_to(pkg)
+        except (ValueError, OSError):
+            outside += 1
+            continue
+        name = frame.f_code.co_name
+        inside.append([f"{PROG}/{rel.as_posix()}", int(line), name if _FUNC_RE.match(name) else "?"])
+    return inside[-MAX_FRAMES:], outside
+
+
+def record_crash(command: str, exc: BaseException) -> None:
+    """Write last-crash.json for an unexpected exception raised while running `command`."""
+    try:
+        frames, outside = _frames(exc.__traceback__)
+        name = type(exc).__qualname__
+        rec = {"time": _now(), "version": __version__,
+               "command": command if _COMMAND_RE.match(command or "") else "unknown",
+               "type": name if _TYPE_RE.match(name) else "Exception",
+               "frames": frames, "outside": outside}
+        _write(state_dir() / CRASH, json.dumps(rec) + "\n")
+    except Exception:   # noqa: BLE001 - recording must never change what the caller does
+        pass
+
+
+def record_denial(source: str, agent: Optional[str], action: str, reason: str,
+                  codes: Sequence[str] = ()) -> None:
+    """Append one denial to denials.jsonl, keeping the last KEEP."""
+    try:
+        if source not in SOURCES:
+            return
+        rec = {"time": _now(), "version": __version__, "source": source,
+               "agent": agent if agent and _WORD_RE.match(agent) else None,
+               "action": action if _WORD_RE.match(action or "") else "other",
+               "reason": reason if reason in REASONS else "problem",
+               "codes": [c for c in codes if isinstance(c, str) and _CODE_RE.match(c)]}
+        path = state_dir() / DENIALS
+        old = path.read_text(encoding="utf-8").splitlines() if path.is_file() else []
+        lines = [ln for ln in old if ln.strip()][-(KEEP - 1):] + [json.dumps(rec)]
+        _write(path, "\n".join(lines) + "\n")
+    except Exception:   # noqa: BLE001
+        pass
+
+
+def read_crash() -> Optional[Dict[str, Any]]:
+    """The parsed last-crash.json, or None. Fields are not validated here; the reader must."""
+    try:
+        data = json.loads((state_dir() / CRASH).read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def read_denials() -> List[Dict[str, Any]]:
+    """The parsed records of denials.jsonl, oldest first (unparsable lines skipped)."""
+    out: List[Dict[str, Any]] = []
+    try:
+        text = (state_dir() / DENIALS).read_text(encoding="utf-8")
+    except OSError:
+        return out
+    for line in text.splitlines():
+        try:
+            rec = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(rec, dict):
+            out.append(rec)
+    return out

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/lint.py

@@ -7,11 +7,14 @@ import subprocess
 from . import keys, render
 from .config import Default, Identity
 from .plan import Env
+from .resolve import is_codecommit
 
 
 def warnings(d: Default, ids: list[Identity], env: Env) -> list[str]:
     out = []
     for i in ids:
+        if is_codecommit(i.host) and i.ssh_user == "git" and (i.ssh_key or i.ssh_alias):
+            out.append(f"identity {i.id!r}: CodeCommit's SSH user is the SSH key ID, not git; set ssh_user to it")
         if i.ssh_alias and i.rewrite:
             out += [f"identity {i.id!r}: owner {o!r} is a glob; insteadOf needs a literal prefix, so "
                     f"its URLs aren't rewritten to {i.ssh_alias}" for o in i.owners if "*" in o]

{gitpro-0.3.2 → gitpro-0.3.4}/src/gitpro/mcp.py

@@ -409,6 +409,23 @@ def tool_identities(args: dict, ctx: Ctx) -> dict:
                             "clone_dir": i.clone_dir, "sign": config.signs(i, d)} for i in cfg.identities]}
 
 
+def tool_draft_report(args: dict, ctx: Ctx) -> dict:
+    """A redacted bug report and its prefilled issue url; nothing is sent, opened or recorded."""
+    from . import report
+    kind = args.get("kind", "bug")
+    repo = _repo(args["path"]) if "path" in args else None
+    try:
+        d = report.build_draft(kind, message=args.get("message"), repo=repo, config=ctx.cfg_path)
+    except report.ReportError as e:
+        raise ToolError(str(e)) from None
+    if d.hits:
+        kinds = ", ".join(dict.fromkeys(h["kind"] for h in d.hits))
+        where = ", ".join(dict.fromkeys(h["section"] for h in d.hits))
+        raise ToolError(f"no draft: it would contain {kinds} in {where}; nothing was shown or sent")
+    return {"ok": True, "command": "report", "title": d.title, "body": d.body, "url": d.url,
+            "security_url": report.ADVISORY_URL, "truncated": d.truncated}
+
+
 # ---------------------------------------------------------------- the registry
 
 def _schema(props: dict, required: Tuple[str, ...] = ()) -> dict:
@@ -487,6 +504,14 @@ TOOLS: Dict[str, Tool] = {t.name: t for t in (
          tool_audit, "gitpro.audit"),
     Tool("identities", "The configured identities (name, email, host, owners, forge accounts, signing); no key "
          "contents, no extra git settings.", _schema({}), tool_identities),
+    Tool("draft_report", "Draft a redacted gitpro bug report (versions, a redacted why, the last crash or "
+         "denial) and the prefilled GitHub issue URL. It never sends or opens anything. Show the user the draft "
+         "and the URL and let them decide; for a security problem, give them security_url instead of an issue.",
+         _schema({"path": PATH, "kind": {"type": "string", "enum": ["bug", "crash", "denial"],
+                                         "description": "what to report (default: bug)"},
+                  "message": {"type": "string", "minLength": 1, "maxLength": 2000,
+                              "description": "what happened (redacted before it is used)"}}),
+         tool_draft_report),
     Tool("preflight", "Versioned operation decision and state token for commit, push or GitHub PR creation. "
          "Read-only; online=true explicitly permits account/destination reads. Ready is not authorization.",
          _schema({"request": REQUEST_SCHEMA, "online": {"type": "boolean"}}, ("request",)), tool_preflight),
@@ -695,6 +720,11 @@ class Server:
             tb = traceback.format_exc()
             sys.stderr.write(tb)
             self.note("!", tb)
+            try:
+                from . import incident
+                incident.record_crash(f"mcp {tool.name}", e)
+            except Exception:  # noqa: BLE001 - recording never changes the answer
+                pass
             return self.failed(f"internal error: {type(e).__name__}")
 
     def result(self, obj: dict) -> dict: