gitvow 0.12.3__tar.gz → 0.12.4__tar.gz

{gitvow-0.12.3/src/gitvow.egg-info → gitvow-0.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.12.3
+Version: 0.12.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.12.3 → gitvow-0.12.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.12.3"
+version = "0.12.4"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.12.3 → gitvow-0.12.4}/src/gitvow/adapters.py

@@ -10,6 +10,8 @@ import shutil
 import subprocess
 from typing import Any
 
+from .decisions import CARD_HEADER
+
 AGENTS = ("claude", "codex", "gemini", "cursor", "copilot", "factory")
 
 # agent event -> gitvow handler
@@ -216,9 +218,15 @@ def normalize(agent: str, event: str, payload: dict[str, Any]) -> list[tuple[str
                 )
             ]
         if event == "beforeMCPExecution":
-            name = tool if tool.startswith("mcp__") else f"mcp__{payload.get('mcp_server_name', 'server')}__{tool}"
+            name = _cursor_mcp(tool, payload)
             return [(gv_event, {**base, "tool_name": name, "tool_input": inp})]
+        # generic preToolUse: Cursor fires this alongside the specific hook for shells and MCP calls,
+        # which would gate and log the same call twice; the specific hook carries the command, so it wins.
+        if tool in ("Shell", "shell", "run_terminal_cmd") and event == "preToolUse":
+            return []
         # generic preToolUse: Cursor's own tool names
+        if tool.startswith("MCP:") or tool.startswith("mcp__"):
+            return [(gv_event, {**base, "tool_name": _cursor_mcp(tool, payload), "tool_input": inp})]
         mapped = {
             "Shell": "Bash",
             "shell": "Bash",
@@ -227,23 +235,47 @@ def normalize(agent: str, event: str, payload: dict[str, Any]) -> list[tuple[str
             "write_file": "Write",
             "Edit": "Edit",
             "Write": "Write",
+            "Delete": "Edit",  # deleting an authorization file is as consequential as editing one
         }.get(tool, tool)
         if mapped == "Bash" and "command" not in inp and payload.get("command"):
             inp["command"] = payload["command"]
+        if mapped in ("Write", "Edit") and "new_content" in inp:
+            # Cursor names the whole new file `new_content`; the gate and providers read `content`
+            inp.setdefault("content", inp["new_content"])
         return [(gv_event, {**base, "tool_name": mapped, "tool_input": inp})]
     return [(gv_event, {**base, "tool_name": tool, "tool_input": inp})]
 
 
+def _cursor_mcp(tool: str, payload: dict[str, Any]) -> str:
+    """Cursor names MCP tools `MCP:<tool>` in preToolUse and passes the server separately."""
+    if tool.startswith("mcp__"):
+        return tool
+    name = tool[4:] if tool.startswith("MCP:") else tool
+    server = str(payload.get("mcp_server_name") or "server")
+    return f"mcp__{server}__{name}"
+
+
+def _refuse(msg: str) -> bool:
+    """Agents with a native permission prompt must refuse, not ask, for these.
+
+    A denial is never negotiable, and the decision card is not a question about running the command:
+    it asks the agent to record the person's answers with `gitvow decide` and run the commit again.
+    Delivered as `ask`, a click on the agent's own approve button would run the commit with the
+    findings still open and no decision recorded anywhere.
+    """
+    return msg.startswith("BLOCKED") or msg.startswith(CARD_HEADER)
+
+
 def respond(agent: str, code: int, msg: str) -> tuple[int, str, str]:
     """(exit code, stdout, stderr) in the agent's form. gitvow's code 2 means blocked; the message says DENY or CONFIRM."""
     if agent == "cursor":
         if code == 2:
-            perm = "deny" if msg.startswith("BLOCKED") else "ask"
+            perm = "deny" if _refuse(msg) else "ask"
             return 0, json.dumps({"permission": perm, "user_message": msg, "agent_message": msg}), ""
         return 0, json.dumps({"permission": "allow"}), msg
     if agent == "copilot":
         if code == 2:
-            perm = "deny" if msg.startswith("BLOCKED") else "ask"
+            perm = "deny" if _refuse(msg) else "ask"
             return 0, json.dumps({"permissionDecision": perm, "permissionDecisionReason": msg}), ""
         return 0, json.dumps({"permissionDecision": "allow"}), msg
     return code, "", msg

{gitvow-0.12.3 → gitvow-0.12.4}/src/gitvow/cli.py

@@ -44,7 +44,17 @@ def cmd_hook(a: argparse.Namespace) -> int:
         print(str(e), file=sys.stderr)
         return 1
     if not calls:
-        return 0  # an event this adapter does not use
+        # An event this adapter does not use. Agents whose contract is a JSON permission object treat
+        # a silent hook as a failed hook, and gitvow installs its hooks fail-closed, so say "allow"
+        # explicitly rather than printing nothing.
+        try:
+            exit_code, out, err = external_respond(exe, 0, "") if exe else respond(agent, 0, "")
+        except AdapterError as e:
+            print(f"BLOCKED: agent adapter failed ({e}).", file=sys.stderr)
+            return 2
+        if out:
+            print(out)
+        return exit_code
     worst, messages = 0, []
     for gv_event, p in calls:
         handler = HANDLERS.get(gv_event)

{gitvow-0.12.3 → gitvow-0.12.4}/src/gitvow/decisions.py

@@ -15,6 +15,7 @@ from .state import git, load_state, save_state
 
 TRAILER_RE = re.compile(r"^Gitvow-(Accepted|Declined|Open):\s*(.+?)(?: by (\S+))?(?: scope=(\S+))?(?:: (.*))?$", re.M)
 REVISITS_RE = re.compile(r"^Gitvow-Revisits:\s*([0-9a-f]{7,40})\b", re.M)
+CARD_HEADER = "DECISIONS REQUIRED"
 MAX_EVIDENCE = 8
 HISTORY_COMMITS = 3000
 
@@ -218,7 +219,7 @@ def card(
     lines = []
     if for_agent:
         lines += [
-            f"DECISIONS REQUIRED before this commit: {len(pending)} finding{'s' if len(pending) != 1 else ''} from this session.",
+            f"{CARD_HEADER} before this commit: {len(pending)} finding{'s' if len(pending) != 1 else ''} from this session.",
             "Put this card to the user. Record each answer with",
             '  gitvow decide <n> accept|decline [--scope <env-or-branch>] [--reason "<phrase>"]',
             "then run the commit again.",

{gitvow-0.12.3 → gitvow-0.12.4}/src/gitvow/hooks/__init__.py

@@ -125,10 +125,9 @@ def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
         pending = dec.undecided(cwd)
         if pending:
             st = load_state(cwd)
-            if rules is not None and st.get("card_user_turns") is None:
-                st["card_user_turns"] = summarize(h.get("transcript_path") or st.get("transcript_path"), rules=rules)[
-                    "user_turns"
-                ]
+            tp = h.get("transcript_path") or st.get("transcript_path")
+            if rules is not None and tp and st.get("card_user_turns") is None:
+                st["card_user_turns"] = summarize(tp, rules=rules)["user_turns"]
                 st["card_shown_at"] = time.strftime("%Y-%m-%dT%H:%M:%S")
                 save_state(cwd, st)
             proposed = dec.mark_proposals(cwd, pol)

{gitvow-0.12.3 → gitvow-0.12.4/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.12.3
+Version: 0.12.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.12.3 → gitvow-0.12.4}/tests/test_adapters.py

@@ -369,3 +369,92 @@ def test_copilot_factory_cli_and_install(repo, home, monkeypatch, capsys):
     assert (repo / ".github" / "hooks" / "gitvow.json").exists()
     uninstall_repo(str(repo), agent="copilot")
     assert not (repo / ".github" / "hooks" / "gitvow.json").exists()
+
+
+def test_cursor_pretooluse_matches_the_documented_payload(repo, home):
+    """Cursor sends Write with new_content for file edits and MCP:<tool> for MCP calls."""
+    from gitvow.adapters import normalize
+
+    ev, p = normalize(
+        "cursor",
+        "preToolUse",
+        {
+            "conversation_id": "cu",
+            "workspace_roots": [str(repo)],
+            "tool_name": "Write",
+            "tool_input": {"file_path": "core/authz_rules.go", "new_content": 'var Public = []string{"/v1/x"}'},
+        },
+    )[0]
+    assert ev == "PreToolUse" and p["tool_name"] == "Write"
+    # the gate and the providers read `content`; Cursor's own key is preserved alongside it
+    assert p["tool_input"]["content"] == 'var Public = []string{"/v1/x"}'
+    assert p["tool_input"]["new_content"] == p["tool_input"]["content"]
+    ev, p = normalize(
+        "cursor",
+        "preToolUse",
+        {
+            "conversation_id": "cu",
+            "workspace_roots": [str(repo)],
+            "tool_name": "Delete",
+            "tool_input": {"file_path": "core/authz_rules.go"},
+        },
+    )[0]
+    assert p["tool_name"] == "Edit"  # a deleted gate-bearing file still reaches the gate
+    for payload, expected in (
+        ({"tool_name": "MCP:drop_table", "mcp_server_name": "postgres"}, "mcp__postgres__drop_table"),
+        ({"tool_name": "MCP:read_rows"}, "mcp__server__read_rows"),
+        ({"tool_name": "mcp__already__mapped"}, "mcp__already__mapped"),
+    ):
+        ev, p = normalize("cursor", "preToolUse", {"conversation_id": "cu", "workspace_roots": [str(repo)], **payload})[
+            0
+        ]
+        assert p["tool_name"] == expected
+
+
+def test_the_card_is_refused_not_asked(repo, home):
+    """On agents with their own approve button, the card must not be clickable past."""
+    from gitvow.adapters import respond
+    from gitvow.decisions import CARD_HEADER
+
+    card = f"{CARD_HEADER} before this commit: 1 finding from this session."
+    for agent, key in (("cursor", "permission"), ("copilot", "permissionDecision")):
+        assert json.loads(respond(agent, 2, card)[1])[key] == "deny"
+        assert json.loads(respond(agent, 2, "BLOCKED by policy (force push).")[1])[key] == "deny"
+        # an immediate confirm rule is a real question for the person, so it stays their prompt
+        assert json.loads(respond(agent, 2, "CONFIRMATION REQUIRED (pushing to a remote).")[1])[key] == "ask"
+
+
+def test_cursor_shell_is_gated_once(repo, home):
+    """Cursor fires preToolUse and beforeShellExecution for the same command."""
+    from gitvow.adapters import normalize
+
+    base = {"conversation_id": "cu", "workspace_roots": [str(repo)]}
+    assert (
+        normalize("cursor", "preToolUse", {**base, "tool_name": "Shell", "tool_input": {"command": "git commit -m x"}})
+        == []
+    )
+    calls = normalize("cursor", "beforeShellExecution", {**base, "command": "git commit -m x"})
+    assert len(calls) == 1 and calls[0][1]["tool_input"]["command"] == "git commit -m x"
+
+
+def test_unused_events_still_answer_in_the_agents_form(repo, home, monkeypatch, capsys):
+    """gitvow's hooks are installed fail-closed; on Cursor and Copilot a silent hook is a failed hook."""
+    import io
+    import sys
+
+    from gitvow import cli
+
+    monkeypatch.chdir(repo)
+    payload = {
+        "conversation_id": "cu",
+        "workspace_roots": [str(repo)],
+        "tool_name": "Shell",
+        "tool_input": {"command": "git commit -m x"},
+    }
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+    assert cli.main(["hook", "--agent", "cursor", "preToolUse"]) == 0
+    assert json.loads(capsys.readouterr().out)["permission"] == "allow"
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps({**payload, "hook_event_name": "beforeReadFile"})))
+    assert cli.main(["hook", "--agent", "copilot", "sessionStart"]) == 0
+    out = capsys.readouterr().out
+    assert not out or json.loads(out).get("permissionDecision") in (None, "allow")