gitvow 0.1.0__tar.gz → 0.1.2__tar.gz

{gitvow-0.1.0/src/gitvow.egg-info → gitvow-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.1.0
+Version: 0.1.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.1.0 → gitvow-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.1.0"
+version = "0.1.2"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}
@@ -35,6 +35,9 @@ Security = "https://github.com/wirevow/gitvow/blob/main/SECURITY.md"
 [tool.setuptools.packages.find]
 where = ["src"]
 
+[tool.setuptools.package-data]
+gitvow = ["default_policy.json"]
+
 [tool.ruff]
 line-length = 120
 target-version = "py39"

gitvow-0.1.2/src/gitvow/__init__.py

@@ -0,0 +1,8 @@
+"""gitvow: provenance and policy gate for AI-agent coding sessions."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("gitvow")
+except PackageNotFoundError:  # running from a source tree that was never installed
+    __version__ = "0.0.0+unknown"

gitvow-0.1.2/src/gitvow/default_policy.json

@@ -0,0 +1,82 @@
+{
+  "_doc": "Default gitvow policy. Regex (Python re) on Bash command text, edited file paths, or MCP tool names. Order: deny \u2192 confirm \u2192 allow; unmatched calls are allowed and logged. Copy to <repo>/.gitvow/policy.json or ~/.gitvow/policy.json to customise.",
+  "bash_deny": [
+    {
+      "pattern": "\\brm\\s+-rf?\\s+(/|~|\\$HOME)(\\s|$)",
+      "reason": "recursive delete of root/home"
+    },
+    {
+      "pattern": "\\bgit\\s+push\\b.*(--force|-f\\b|\\+refs)",
+      "reason": "force push"
+    },
+    {
+      "pattern": "\\bgit\\s+(reset\\s+--hard|clean\\s+-fd|branch\\s+-D)\\b",
+      "reason": "destructive git history/worktree operation"
+    },
+    {
+      "pattern": "\\bkubectl\\s+(delete|drain|cordon)\\b",
+      "reason": "destructive kubectl"
+    },
+    {
+      "pattern": "\\b(terraform|pulumi)\\s+(destroy|apply)\\b",
+      "reason": "infrastructure mutation"
+    },
+    {
+      "pattern": "\\bDROP\\s+(TABLE|DATABASE|SCHEMA)\\b",
+      "reason": "destructive SQL"
+    },
+    {
+      "pattern": "\\baws\\s+\\S+\\s+(delete|terminate|deregister)\\S*",
+      "reason": "destructive AWS CLI"
+    },
+    {
+      "pattern": "curl[^|]*\\|\\s*(ba)?sh\\b",
+      "reason": "pipe remote script to shell"
+    }
+  ],
+  "bash_confirm": [
+    {
+      "pattern": "\\bgit\\s+push\\b",
+      "reason": "pushing to a remote"
+    },
+    {
+      "pattern": "\\bkubectl\\s+(apply|rollout|set|scale|exec)\\b",
+      "reason": "cluster mutation"
+    },
+    {
+      "pattern": "\\bhelm\\s+(install|upgrade|uninstall)\\b",
+      "reason": "helm release change"
+    },
+    {
+      "pattern": "\\bgh\\s+(pr\\s+merge|release\\s+create|repo\\s+delete)\\b",
+      "reason": "GitHub mutation"
+    }
+  ],
+  "path_confirm": [
+    {
+      "pattern": "(^|/)values/production-[a-z]+/.*\\.ya?ml$",
+      "reason": "edits production GitOps values"
+    },
+    {
+      "pattern": "(^|/)\\.github/workflows/|Jenkinsfile",
+      "reason": "edits CI definitions"
+    },
+    {
+      "pattern": "(^|/)\\.gitvow/(policy\\.json|hooks/)|(^|/)\\.claude/settings.*\\.json",
+      "reason": "edits the gate policy or the hook configuration"
+    },
+    {
+      "pattern": "(^|/)(auth|authz|authorization|gate|whitelist|allowlist)[^/]*\\.(java|go|py|ts|js|ya?ml)$",
+      "reason": "edits an authorization or gate-bearing file"
+    }
+  ],
+  "mcp_allow": [],
+  "mcp_deny": [
+    "mcp__.*__(delete|remove|destroy|drop)_.*"
+  ],
+  "llm_classifier": {
+    "enabled": false,
+    "command": "",
+    "_doc": "Optional: a command that reads the hook JSON on stdin and prints ALLOW|CONFIRM|DENY <reason>. Used only for calls not matched above."
+  }
+}

{gitvow-0.1.0 → gitvow-0.1.2/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.1.0
+Version: 0.1.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.1.0 → gitvow-0.1.2}/src/gitvow.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ pyproject.toml
 src/gitvow/__init__.py
 src/gitvow/cli.py
 src/gitvow/collect.py
+src/gitvow/default_policy.json
 src/gitvow/install.py
 src/gitvow/policy.py
 src/gitvow/redact.py
@@ -20,5 +21,6 @@ src/gitvow/hooks/__init__.py
 tests/test_collect.py
 tests/test_hooks.py
 tests/test_install_cli.py
+tests/test_packaging.py
 tests/test_policy.py
 tests/test_redact.py

gitvow-0.1.2/tests/test_packaging.py

@@ -0,0 +1,37 @@
+"""Build the wheel, install it into a clean venv, and run the self-check from there.
+
+Guards against package-data omissions: a wheel without default_policy.json fails closed and blocks everything.
+"""
+
+import os
+import subprocess
+import sys
+import venv
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+@pytest.mark.skipif(os.environ.get("GITVOW_SKIP_PACKAGING") == "1", reason="packaging test disabled")
+def test_wheel_contains_policy_and_selftest_passes(tmp_path):
+    subprocess.run(
+        [sys.executable, "-m", "pip", "wheel", "-q", "--no-deps", "-w", str(tmp_path), str(ROOT)], check=True
+    )
+    wheel = next(tmp_path.glob("gitvow-*.whl"))
+    import zipfile
+
+    assert "gitvow/default_policy.json" in zipfile.ZipFile(wheel).namelist()
+    env_dir = tmp_path / "venv"
+    venv.EnvBuilder(with_pip=True).create(env_dir)
+    bin_dir = env_dir / ("Scripts" if os.name == "nt" else "bin")
+    subprocess.run([str(bin_dir / "python"), "-m", "pip", "install", "-q", str(wheel)], check=True)
+    r = subprocess.run([str(bin_dir / "gitvow"), "selftest"], capture_output=True, text=True, cwd=tmp_path)
+    assert r.returncode == 0, r.stdout + r.stderr
+    assert "0 failed" in r.stdout
+    import re
+
+    expected = re.search(r'^version = "([^"]+)"', (ROOT / "pyproject.toml").read_text(), re.M).group(1)
+    v = subprocess.run([str(bin_dir / "gitvow"), "--version"], capture_output=True, text=True, check=True)
+    assert v.stdout.strip() == f"gitvow {expected}"

gitvow-0.1.0/src/gitvow/__init__.py

@@ -1,3 +0,0 @@
-"""gitvow: provenance and policy gate for AI-agent coding sessions."""
-
-__version__ = "0.1.0"