gitvow 0.12.2__tar.gz → 0.12.4__tar.gz

{gitvow-0.12.2/src/gitvow.egg-info → gitvow-0.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.12.2
+Version: 0.12.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.12.2 → gitvow-0.12.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.12.2"
+version = "0.12.4"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.12.2 → gitvow-0.12.4}/src/gitvow/adapters.py

@@ -10,6 +10,8 @@ import shutil
 import subprocess
 from typing import Any
 
+from .decisions import CARD_HEADER
+
 AGENTS = ("claude", "codex", "gemini", "cursor", "copilot", "factory")
 
 # agent event -> gitvow handler
@@ -216,9 +218,15 @@ def normalize(agent: str, event: str, payload: dict[str, Any]) -> list[tuple[str
                 )
             ]
         if event == "beforeMCPExecution":
-            name = tool if tool.startswith("mcp__") else f"mcp__{payload.get('mcp_server_name', 'server')}__{tool}"
+            name = _cursor_mcp(tool, payload)
             return [(gv_event, {**base, "tool_name": name, "tool_input": inp})]
+        # generic preToolUse: Cursor fires this alongside the specific hook for shells and MCP calls,
+        # which would gate and log the same call twice; the specific hook carries the command, so it wins.
+        if tool in ("Shell", "shell", "run_terminal_cmd") and event == "preToolUse":
+            return []
         # generic preToolUse: Cursor's own tool names
+        if tool.startswith("MCP:") or tool.startswith("mcp__"):
+            return [(gv_event, {**base, "tool_name": _cursor_mcp(tool, payload), "tool_input": inp})]
         mapped = {
             "Shell": "Bash",
             "shell": "Bash",
@@ -227,23 +235,47 @@ def normalize(agent: str, event: str, payload: dict[str, Any]) -> list[tuple[str
             "write_file": "Write",
             "Edit": "Edit",
             "Write": "Write",
+            "Delete": "Edit",  # deleting an authorization file is as consequential as editing one
         }.get(tool, tool)
         if mapped == "Bash" and "command" not in inp and payload.get("command"):
             inp["command"] = payload["command"]
+        if mapped in ("Write", "Edit") and "new_content" in inp:
+            # Cursor names the whole new file `new_content`; the gate and providers read `content`
+            inp.setdefault("content", inp["new_content"])
         return [(gv_event, {**base, "tool_name": mapped, "tool_input": inp})]
     return [(gv_event, {**base, "tool_name": tool, "tool_input": inp})]
 
 
+def _cursor_mcp(tool: str, payload: dict[str, Any]) -> str:
+    """Cursor names MCP tools `MCP:<tool>` in preToolUse and passes the server separately."""
+    if tool.startswith("mcp__"):
+        return tool
+    name = tool[4:] if tool.startswith("MCP:") else tool
+    server = str(payload.get("mcp_server_name") or "server")
+    return f"mcp__{server}__{name}"
+
+
+def _refuse(msg: str) -> bool:
+    """Agents with a native permission prompt must refuse, not ask, for these.
+
+    A denial is never negotiable, and the decision card is not a question about running the command:
+    it asks the agent to record the person's answers with `gitvow decide` and run the commit again.
+    Delivered as `ask`, a click on the agent's own approve button would run the commit with the
+    findings still open and no decision recorded anywhere.
+    """
+    return msg.startswith("BLOCKED") or msg.startswith(CARD_HEADER)
+
+
 def respond(agent: str, code: int, msg: str) -> tuple[int, str, str]:
     """(exit code, stdout, stderr) in the agent's form. gitvow's code 2 means blocked; the message says DENY or CONFIRM."""
     if agent == "cursor":
         if code == 2:
-            perm = "deny" if msg.startswith("BLOCKED") else "ask"
+            perm = "deny" if _refuse(msg) else "ask"
             return 0, json.dumps({"permission": perm, "user_message": msg, "agent_message": msg}), ""
         return 0, json.dumps({"permission": "allow"}), msg
     if agent == "copilot":
         if code == 2:
-            perm = "deny" if msg.startswith("BLOCKED") else "ask"
+            perm = "deny" if _refuse(msg) else "ask"
             return 0, json.dumps({"permissionDecision": perm, "permissionDecisionReason": msg}), ""
         return 0, json.dumps({"permissionDecision": "allow"}), msg
     return code, "", msg

{gitvow-0.12.2 → gitvow-0.12.4}/src/gitvow/cli.py

@@ -44,7 +44,17 @@ def cmd_hook(a: argparse.Namespace) -> int:
         print(str(e), file=sys.stderr)
         return 1
     if not calls:
-        return 0  # an event this adapter does not use
+        # An event this adapter does not use. Agents whose contract is a JSON permission object treat
+        # a silent hook as a failed hook, and gitvow installs its hooks fail-closed, so say "allow"
+        # explicitly rather than printing nothing.
+        try:
+            exit_code, out, err = external_respond(exe, 0, "") if exe else respond(agent, 0, "")
+        except AdapterError as e:
+            print(f"BLOCKED: agent adapter failed ({e}).", file=sys.stderr)
+            return 2
+        if out:
+            print(out)
+        return exit_code
     worst, messages = 0, []
     for gv_event, p in calls:
         handler = HANDLERS.get(gv_event)

{gitvow-0.12.2 → gitvow-0.12.4}/src/gitvow/decisions.py

@@ -15,6 +15,7 @@ from .state import git, load_state, save_state
 
 TRAILER_RE = re.compile(r"^Gitvow-(Accepted|Declined|Open):\s*(.+?)(?: by (\S+))?(?: scope=(\S+))?(?:: (.*))?$", re.M)
 REVISITS_RE = re.compile(r"^Gitvow-Revisits:\s*([0-9a-f]{7,40})\b", re.M)
+CARD_HEADER = "DECISIONS REQUIRED"
 MAX_EVIDENCE = 8
 HISTORY_COMMITS = 3000
 
@@ -218,7 +219,7 @@ def card(
     lines = []
     if for_agent:
         lines += [
-            f"DECISIONS REQUIRED before this commit: {len(pending)} finding{'s' if len(pending) != 1 else ''} from this session.",
+            f"{CARD_HEADER} before this commit: {len(pending)} finding{'s' if len(pending) != 1 else ''} from this session.",
             "Put this card to the user. Record each answer with",
             '  gitvow decide <n> accept|decline [--scope <env-or-branch>] [--reason "<phrase>"]',
             "then run the commit again.",

{gitvow-0.12.2 → gitvow-0.12.4}/src/gitvow/hooks/__init__.py

@@ -125,10 +125,9 @@ def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
         pending = dec.undecided(cwd)
         if pending:
             st = load_state(cwd)
-            if rules is not None and st.get("card_user_turns") is None:
-                st["card_user_turns"] = summarize(h.get("transcript_path") or st.get("transcript_path"), rules=rules)[
-                    "user_turns"
-                ]
+            tp = h.get("transcript_path") or st.get("transcript_path")
+            if rules is not None and tp and st.get("card_user_turns") is None:
+                st["card_user_turns"] = summarize(tp, rules=rules)["user_turns"]
                 st["card_shown_at"] = time.strftime("%Y-%m-%dT%H:%M:%S")
                 save_state(cwd, st)
             proposed = dec.mark_proposals(cwd, pol)

{gitvow-0.12.2 → gitvow-0.12.4}/src/gitvow/transcript.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 from collections.abc import Iterable
 from typing import Any
 
@@ -40,8 +41,6 @@ def _text_of(content: Any) -> str:
 
 
 def _patch_files(text: str) -> list[str]:
-    import re
-
     return re.findall(r"^\*\*\* (?:Update|Add|Delete) File: (.+)$", text or "", re.M)
 
 
@@ -167,13 +166,50 @@ def _finish_usage(usage: dict[str, Any]) -> None:
     )
 
 
-def _is_person_text(content: Any) -> bool:
-    """A user message typed by a person, not a tool_result the harness sent back."""
+INJECTED_RE = re.compile(r"^\s*<[a-z_]+>")  # Codex prepends <recommended_plugins>, <environment_context> and the like
+PERSON_TEXT = ("text", "input_text")
+
+
+def _person_text(content: Any) -> str:
     if isinstance(content, str):
-        return bool(content.strip())
+        return content
     if isinstance(content, list):
-        return any(isinstance(c, dict) and c.get("type") == "text" and str(c.get("text", "")).strip() for c in content)
-    return False
+        return "\n".join(
+            str(c.get("text", ""))
+            for c in content
+            if isinstance(c, dict) and c.get("type") in PERSON_TEXT and str(c.get("text", "")).strip()
+        )
+    return ""
+
+
+def _is_person_text(content: Any) -> bool:
+    """A user message typed by a person: not a tool result, and not a block the harness injected."""
+    text = _person_text(content).strip()
+    return bool(text) and not INJECTED_RE.match(text)
+
+
+TOOLS_CALL_RE = re.compile(r"tools\.([A-Za-z_][A-Za-z0-9_]*)\s*\(")
+
+
+def _codex_unwrap(text: str) -> list[tuple[str, Any]]:
+    """Codex 0.15 wraps every tool call in a JavaScript snippet: `await tools.exec_command({...})`.
+
+    Returns (function name, decoded argument) pairs; the argument is whatever JSON follows the bracket.
+    """
+    out: list[tuple[str, Any]] = []
+    dec = json.JSONDecoder()
+    for m in TOOLS_CALL_RE.finditer(text or ""):
+        i = m.end()
+        while i < len(text) and text[i] in " \t\n\r":
+            i += 1
+        arg: Any = ""
+        if i < len(text) and text[i] in '{"[':
+            try:
+                arg, _ = dec.raw_decode(text, i)
+            except ValueError:
+                arg = ""
+        out.append((m.group(1), arg))
+    return out
 
 
 def _add_tool(out: dict[str, Any], tool: str, brief: str, rules: list[tuple[str, str]], max_tools: int) -> None:
@@ -256,9 +292,11 @@ def _codex_event(
         elif pt in ("function_call", "custom_tool_call", "local_shell_call"):
             name = str(p.get("name") or ("local_shell" if pt == "local_shell_call" else ""))
             arguments = p.get("arguments") if pt == "function_call" else (p.get("input") or p.get("action") or "")
-            tool, brief, files = _codex_tool(name, arguments)
-            _add_tool(out, tool, brief, rules, max_tools)
-            written.update(files)
+            inner = _codex_unwrap(arguments) if isinstance(arguments, str) and "tools." in arguments else []
+            for fn, arg in inner or [(name, arguments)]:
+                tool, brief, files = _codex_tool(fn, arg)
+                _add_tool(out, tool, brief, rules, max_tools)
+                written.update(files)
     elif t == "turn_context":
         if p.get("model"):
             out["_codex_model"] = str(p["model"])

{gitvow-0.12.2 → gitvow-0.12.4/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.12.2
+Version: 0.12.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.12.2 → gitvow-0.12.4}/tests/test_adapters.py

@@ -369,3 +369,92 @@ def test_copilot_factory_cli_and_install(repo, home, monkeypatch, capsys):
     assert (repo / ".github" / "hooks" / "gitvow.json").exists()
     uninstall_repo(str(repo), agent="copilot")
     assert not (repo / ".github" / "hooks" / "gitvow.json").exists()
+
+
+def test_cursor_pretooluse_matches_the_documented_payload(repo, home):
+    """Cursor sends Write with new_content for file edits and MCP:<tool> for MCP calls."""
+    from gitvow.adapters import normalize
+
+    ev, p = normalize(
+        "cursor",
+        "preToolUse",
+        {
+            "conversation_id": "cu",
+            "workspace_roots": [str(repo)],
+            "tool_name": "Write",
+            "tool_input": {"file_path": "core/authz_rules.go", "new_content": 'var Public = []string{"/v1/x"}'},
+        },
+    )[0]
+    assert ev == "PreToolUse" and p["tool_name"] == "Write"
+    # the gate and the providers read `content`; Cursor's own key is preserved alongside it
+    assert p["tool_input"]["content"] == 'var Public = []string{"/v1/x"}'
+    assert p["tool_input"]["new_content"] == p["tool_input"]["content"]
+    ev, p = normalize(
+        "cursor",
+        "preToolUse",
+        {
+            "conversation_id": "cu",
+            "workspace_roots": [str(repo)],
+            "tool_name": "Delete",
+            "tool_input": {"file_path": "core/authz_rules.go"},
+        },
+    )[0]
+    assert p["tool_name"] == "Edit"  # a deleted gate-bearing file still reaches the gate
+    for payload, expected in (
+        ({"tool_name": "MCP:drop_table", "mcp_server_name": "postgres"}, "mcp__postgres__drop_table"),
+        ({"tool_name": "MCP:read_rows"}, "mcp__server__read_rows"),
+        ({"tool_name": "mcp__already__mapped"}, "mcp__already__mapped"),
+    ):
+        ev, p = normalize("cursor", "preToolUse", {"conversation_id": "cu", "workspace_roots": [str(repo)], **payload})[
+            0
+        ]
+        assert p["tool_name"] == expected
+
+
+def test_the_card_is_refused_not_asked(repo, home):
+    """On agents with their own approve button, the card must not be clickable past."""
+    from gitvow.adapters import respond
+    from gitvow.decisions import CARD_HEADER
+
+    card = f"{CARD_HEADER} before this commit: 1 finding from this session."
+    for agent, key in (("cursor", "permission"), ("copilot", "permissionDecision")):
+        assert json.loads(respond(agent, 2, card)[1])[key] == "deny"
+        assert json.loads(respond(agent, 2, "BLOCKED by policy (force push).")[1])[key] == "deny"
+        # an immediate confirm rule is a real question for the person, so it stays their prompt
+        assert json.loads(respond(agent, 2, "CONFIRMATION REQUIRED (pushing to a remote).")[1])[key] == "ask"
+
+
+def test_cursor_shell_is_gated_once(repo, home):
+    """Cursor fires preToolUse and beforeShellExecution for the same command."""
+    from gitvow.adapters import normalize
+
+    base = {"conversation_id": "cu", "workspace_roots": [str(repo)]}
+    assert (
+        normalize("cursor", "preToolUse", {**base, "tool_name": "Shell", "tool_input": {"command": "git commit -m x"}})
+        == []
+    )
+    calls = normalize("cursor", "beforeShellExecution", {**base, "command": "git commit -m x"})
+    assert len(calls) == 1 and calls[0][1]["tool_input"]["command"] == "git commit -m x"
+
+
+def test_unused_events_still_answer_in_the_agents_form(repo, home, monkeypatch, capsys):
+    """gitvow's hooks are installed fail-closed; on Cursor and Copilot a silent hook is a failed hook."""
+    import io
+    import sys
+
+    from gitvow import cli
+
+    monkeypatch.chdir(repo)
+    payload = {
+        "conversation_id": "cu",
+        "workspace_roots": [str(repo)],
+        "tool_name": "Shell",
+        "tool_input": {"command": "git commit -m x"},
+    }
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+    assert cli.main(["hook", "--agent", "cursor", "preToolUse"]) == 0
+    assert json.loads(capsys.readouterr().out)["permission"] == "allow"
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps({**payload, "hook_event_name": "beforeReadFile"})))
+    assert cli.main(["hook", "--agent", "copilot", "sessionStart"]) == 0
+    out = capsys.readouterr().out
+    assert not out or json.loads(out).get("permissionDecision") in (None, "allow")

{gitvow-0.12.2 → gitvow-0.12.4}/tests/test_transcript_formats.py

@@ -126,3 +126,62 @@ def test_claude_format_still_default(transcript):
 def test_redaction_applies_to_all_formats(tmp_path):
     s = summarize(_write(tmp_path, "rollout.jsonl", CODEX[:4]))
     assert "[github-token]" in s["last_assistant_text"] and "ghp_" not in s["last_assistant_text"]
+
+
+# Codex 0.15 shape, captured from a real session: one `exec` custom tool whose input is a JavaScript
+# snippet calling tools.exec_command / tools.apply_patch, and user text as input_text parts.
+CODEX_WRAPPED = [
+    {"timestamp": "t", "type": "session_meta", "payload": {"id": "c2", "cwd": "/r"}},
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {
+            "type": "message",
+            "role": "user",
+            "content": [{"type": "input_text", "text": "<recommended_plugins>\nAirtable\n</recommended_plugins>"}],
+        },
+    },
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {"type": "message", "role": "user", "content": [{"type": "input_text", "text": "fix add"}]},
+    },
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {
+            "type": "custom_tool_call",
+            "name": "exec",
+            "input": 'const r = await tools.exec_command({"cmd":"git status","workdir":"/r"});\nconsole.log(r);',
+        },
+    },
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {
+            "type": "custom_tool_call",
+            "name": "exec",
+            "input": 'await tools.apply_patch("*** Begin Patch\\n*** Update File: /r/calc.py\\n+a + b\\n*** End Patch\\n");',
+        },
+    },
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {"type": "message", "role": "assistant", "content": [{"type": "output_text", "text": "Fixed."}]},
+    },
+    {
+        "timestamp": "t",
+        "type": "response_item",
+        "payload": {"type": "message", "role": "user", "content": [{"type": "input_text", "text": "accept it"}]},
+    },
+]
+
+
+def test_codex_wrapped_tool_calls_and_user_turns(tmp_path):
+    s = summarize(_write(tmp_path, "rollout.jsonl", CODEX_WRAPPED))
+    assert s["format"] == "codex"
+    assert [t["tool"] for t in s["tool_calls"]] == ["Bash", "Edit"]
+    assert s["tool_calls"][0]["arg"] == "git status" and s["tool_calls"][1]["arg"] == "/r/calc.py"
+    assert s["files_written"] == ["/r/calc.py"]
+    # the injected <recommended_plugins> block is not a person speaking; the two real prompts are
+    assert s["user_turns"] == 2