gitvow 0.24.0__tar.gz → 0.26.0__tar.gz

{gitvow-0.24.0/src/gitvow.egg-info → gitvow-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.24.0
+Version: 0.26.0
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.24.0 → gitvow-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.24.0"
+version = "0.26.0"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/claims.py

@@ -576,7 +576,10 @@ def write_section(path: str, block: str) -> str:
         action = "added"
     else:
         return "nothing to write"
-    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
-    with open(path, "w") as fh:
-        fh.write(new)
+    from .safewrite import check_target, write_if_changed
+    from .state import toplevel
+
+    target = check_target(path, toplevel(os.path.dirname(path) or "."))
+    if not write_if_changed(target, new):
+        return f"managed claims section in {path} already current"
     return f"{action} managed claims section in {path}"

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/cli.py

@@ -115,8 +115,14 @@ def cmd_install(a: argparse.Namespace) -> int:
     lines: list[str] = []
     if detected:
         lines.append(f"agents found here: {', '.join(agents)}  (use --agent to pick one)")
+    from .safewrite import UnsafeTargetError
+
     for agent in agents:
-        lines += install_user(home, agent=agent) if a.user else install_repo(repo, agent=agent)
+        try:
+            lines += install_user(home, agent=agent) if a.user else install_repo(repo, agent=agent)
+        except UnsafeTargetError as e:
+            print(f"refused: {e}", file=sys.stderr)
+            return 1
     seen: set[str] = set()
     for ln in lines:
         if ln not in seen:
@@ -212,8 +218,11 @@ def cmd_coverage(a: argparse.Namespace) -> int:
 
 def cmd_status(a: argparse.Namespace) -> int:
     """Is the record actually being written here? Reports what is missing and the line that fixes it."""
-    from .status import build, render
+    from .status import badge, build, render
 
+    if a.line:
+        print(badge(os.getcwd()))
+        return 0
     checks = build(os.getcwd(), os.path.expanduser("~"))
     if a.json:
         print(json.dumps([{"state": s, "what": w, "fix": f} for s, w, f in checks], indent=1))
@@ -890,6 +899,9 @@ def main(argv: list[str] | None = None) -> int:
     s.set_defaults(f=cmd_coverage)
     s = sub.add_parser("status", help="check the install is live: hooks reachable, policy loads, git hooks in place")
     s.add_argument("--json", action="store_true")
+    s.add_argument(
+        "--line", action="store_true", help="one line for a status bar: what this repository's session recorded"
+    )
     s.set_defaults(f=cmd_status)
     s = sub.add_parser("sync", help="export the record and deliver it to the configured sinks; never the session")
     s.add_argument("--sink", help="deliver to this sink only")

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/decisions.py

@@ -379,8 +379,8 @@ def _elsewhere_line(elsewhere: dict[str, Any]) -> str:
     total = sum(int(v.get("count", 0)) for v in elsewhere.values())
     names = ", ".join(sorted(elsewhere)[:4])
     return (
-        f"Edits outside this repository: {total} in {names}. They were gated by this repository's policy and are "
-        f"recorded in this repository's note, not in theirs.\n"
+        f"Edits outside this repository: {total} in {names}. Each was gated by that repository's own policy and "
+        f"recorded in its state and notes; this repository's note names them too.\n"
     )
 
 

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/hooks/__init__.py

@@ -10,6 +10,7 @@ from typing import Any
 
 from .. import decisions as dec
 from .. import snapshots
+from ..paths import is_credential_path
 from ..policy import PolicyError, confirm_message, evaluate, load_policy, message_for
 from ..pricing import estimate
 from ..redact import RedactionError, load_rules, redact
@@ -110,10 +111,58 @@ def _rules_or_none(cwd: str, home: str | None) -> tuple[list[tuple[str, str]] |
         return None, f"gitvow: {e}. {REDACTION_UNAVAILABLE}."
 
 
+_GIT_C_RE = re.compile(r"\bgit\b[^|;&\n]*?\s-C\s+(\"[^\"]+\"|'[^']+'|\S+)")
+_CD_RE = re.compile(r"^\s*cd\s+(\"[^\"]+\"|'[^']+'|\S+)\s*(?:&&|;)")
+
+
+def target_cwd(tool: str, inp: dict[str, Any], cwd: str) -> str:
+    """The repository a tool call is about, which is not always the one the session started in.
+
+    The record lives in the repository the change is about. A session opened in one checkout that edits a file
+    in another, or runs `git -C ../other commit` or `cd other && git commit`, is gated by that other repository's
+    policy and recorded in its state, notes and trailers; the replay of three engineers' sessions found 28% of
+    edits landing outside the session's own checkout, and until 0.25 every one of those was recorded against the
+    wrong repository or not at all. Anything that is not inside another repository falls back to the session's cwd.
+    """
+    cand: str | None = None
+    if tool in EDIT_TOOLS:
+        fp = str(inp.get("file_path") or inp.get("notebook_path") or "")
+        if fp:
+            cand = os.path.dirname(fp if os.path.isabs(fp) else os.path.join(cwd, fp))
+    elif tool == "Bash":
+        cmd = inp.get("command") or ""
+        m = _GIT_C_RE.search(cmd) or _CD_RE.match(cmd)
+        if m:
+            p = os.path.expanduser(m.group(1).strip("'\""))
+            cand = p if os.path.isabs(p) else os.path.join(cwd, p)
+    while cand and not os.path.isdir(cand):
+        parent = os.path.dirname(cand)
+        cand = parent if parent != cand else None
+    if not cand:
+        return cwd
+    top, here = toplevel(cand), toplevel(cwd)
+    if not top or (here and os.path.realpath(top) == os.path.realpath(here)):
+        return cwd
+    return top
+
+
+def _note_touched(session_cwd: str, target: str) -> None:
+    """The session's own state remembers every other repository it reached, so the ledger can list them."""
+    if os.path.realpath(session_cwd) == os.path.realpath(target):
+        return
+    st = load_state(session_cwd)
+    touched = st.setdefault("repos_touched", [])
+    if target not in touched:
+        touched.append(target)
+        save_state(session_cwd, st)
+
+
 def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
-    cwd = h.get("cwd") or os.getcwd()
+    session_cwd = h.get("cwd") or os.getcwd()
     tool = h.get("tool_name", "") or ""
     inp = h.get("tool_input") or {}
+    cwd = target_cwd(tool, inp, session_cwd)
+    _note_touched(session_cwd, cwd)
     try:
         pol = load_policy(cwd, home)
     except PolicyError as e:
@@ -233,6 +282,18 @@ def _record_prompt_approval(cwd: str, inp: dict[str, Any], home: str | None) ->
     log_event(cwd, "prompt_approval_recorded", {"finding": n, "reason": d.reason[:120]})
 
 
+def _count_elsewhere(session_cwd: str, other_top: str, abs_path: str) -> None:
+    """Count an edit that landed in another repository against this session, by that repository's name."""
+    st = load_state(session_cwd)
+    key = os.path.basename(other_top.rstrip("/")) or other_top
+    ent = st.setdefault("edits_elsewhere", {}).setdefault(key, {"count": 0, "paths": []})
+    ent["count"] += 1
+    p = os.path.relpath(os.path.realpath(abs_path), os.path.realpath(other_top))
+    if p not in ent["paths"] and len(ent["paths"]) < 20:
+        ent["paths"].append(p)
+    save_state(session_cwd, st)
+
+
 def _record_agent_blob(cwd: str, file_path: str) -> None:
     """After an agent edit, remember the blob id of what the agent wrote (repo-relative path -> blob).
 
@@ -250,14 +311,11 @@ def _record_agent_blob(cwd: str, file_path: str) -> None:
     if rel.startswith(".."):
         other = toplevel(os.path.dirname(abs_path))
         if other and os.path.realpath(other) != os.path.realpath(top):
-            st = load_state(cwd)
-            key = os.path.basename(other.rstrip("/")) or other
-            ent = st.setdefault("edits_elsewhere", {}).setdefault(key, {"count": 0, "paths": []})
-            ent["count"] += 1
-            p = os.path.relpath(os.path.realpath(abs_path), os.path.realpath(other))
-            if p not in ent["paths"] and len(ent["paths"]) < 20:
-                ent["paths"].append(p)
-            save_state(cwd, st)
+            _count_elsewhere(cwd, other, abs_path)
+        return
+    if is_credential_path(rel):
+        # the path says credential store: attribution loses one file, the object store never holds its content
+        log_event(cwd, "blob_skipped", {"reason": "credential-store path", "path": rel})
         return
     rc, blob, _ = git(["hash-object", "-w", "--", abs_path], top)
     if rc != 0:
@@ -314,13 +372,18 @@ def _attribution(cwd: str, head: str, agent_blobs: dict[str, str], transcript_wr
 
 
 def post_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
-    cwd = h.get("cwd") or os.getcwd()
-    tool = h.get("tool_name")
+    tool = h.get("tool_name") or ""
     inp = h.get("tool_input") or {}
+    session_cwd = h.get("cwd") or os.getcwd()
+    cwd = target_cwd(tool, inp, session_cwd)
     if tool in EDIT_TOOLS:
         fp = str(inp.get("file_path") or inp.get("notebook_path") or "")
         if fp:
             _record_agent_blob(cwd, fp)
+            if os.path.realpath(cwd) != os.path.realpath(session_cwd):
+                # gated and recorded in the other repository (0.25), and still counted here so this
+                # repository's card and note say the session reached elsewhere
+                _count_elsewhere(session_cwd, cwd, fp if os.path.isabs(fp) else os.path.join(session_cwd, fp))
         try:
             pol = load_policy(cwd, home)
         except PolicyError:
@@ -414,6 +477,7 @@ def stop(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
         "assistant_turns": summ["turns"],
         "tool_calls": summ["tool_calls"],
         "commits_during_session": commits,
+        "repos_touched": st.get("repos_touched") or [],
         "last_stated_plan": summ["last_assistant_text"],
         "usage": estimate(summ["usage"], _policy_or_empty(cwd, home)),
         "subagents": summ["subagents"],

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/install.py

@@ -8,6 +8,7 @@ import shutil
 import sys
 from typing import Any
 
+from .safewrite import check_target, write_if_changed
 from .state import git
 
 GIT_HOOK = """#!/bin/sh
@@ -263,7 +264,7 @@ def _external_files(info: dict[str, Any]) -> tuple[str, str]:
     )
 
 
-def merge_external_settings(path: str, info: dict[str, Any], cmd_prefix: str) -> None:
+def merge_external_settings(path: str, info: dict[str, Any], cmd_prefix: str, root: str | None = None) -> None:
     inst = info.get("install") or {}
     cur: dict[str, Any] = {}
     if os.path.exists(path):
@@ -276,9 +277,12 @@ def merge_external_settings(path: str, info: dict[str, Any], cmd_prefix: str) ->
         rendered = json.loads(json.dumps(entries).replace("__GITVOW__", cmd_prefix))
         kept = [x for x in hooks.get(ev, []) if not _is_ours(x)]
         hooks[ev] = kept + rendered
-    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
-    with open(path, "w") as fh:
-        json.dump(cur, fh, indent=2)
+    _write_json(path, cur, root)
+
+
+def _write_json(path: str, data: dict[str, Any], root: str | None) -> None:
+    target = check_target(path, root)
+    write_if_changed(target, json.dumps(data, indent=2))
 
 
 def _is_ours(entry: dict[str, Any]) -> bool:
@@ -287,7 +291,7 @@ def _is_ours(entry: dict[str, Any]) -> bool:
     return any(MARKER in (h.get("command") or "") for h in entry.get("hooks", []))
 
 
-def merge_agent_settings(path: str, agent: str, cmd_prefix: str) -> None:
+def merge_agent_settings(path: str, agent: str, cmd_prefix: str, root: str | None = None) -> None:
     cur: dict[str, Any] = {}
     if os.path.exists(path):
         with open(path) as fh:
@@ -298,9 +302,7 @@ def merge_agent_settings(path: str, agent: str, cmd_prefix: str) -> None:
     for ev, entries in _agent_entries(agent, cmd_prefix).items():
         kept = [x for x in hooks.get(ev, []) if not _is_ours(x)]
         hooks[ev] = kept + entries
-    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
-    with open(path, "w") as fh:
-        json.dump(cur, fh, indent=2)
+    _write_json(path, cur, root)
 
 
 def unmerge_agent_settings(path: str) -> None:
@@ -322,7 +324,7 @@ def unmerge_agent_settings(path: str) -> None:
         os.remove(path)
 
 
-def merge_settings(path: str, cmd_prefix: str) -> None:
+def merge_settings(path: str, cmd_prefix: str, root: str | None = None) -> None:
     cur: dict[str, Any] = {}
     if os.path.exists(path):
         with open(path) as fh:
@@ -331,9 +333,7 @@ def merge_settings(path: str, cmd_prefix: str) -> None:
     for ev, entries in _hook_entries(cmd_prefix).items():
         kept = [x for x in hooks.get(ev, []) if not any(MARKER in (h.get("command") or "") for h in x.get("hooks", []))]
         hooks[ev] = kept + entries
-    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
-    with open(path, "w") as fh:
-        json.dump(cur, fh, indent=2)
+    _write_json(path, cur, root)
 
 
 def unmerge_settings(path: str) -> None:
@@ -497,13 +497,13 @@ def stale_git_hooks(dirpath: str) -> list[str]:
     return out
 
 
-def _write_git_hook(dirpath: str) -> str:
+def _write_git_hook(dirpath: str, root: str | None = None) -> str:
+    """Write the four hooks. Bytes that are already current are left alone, so a rerun does not move the
+    install stamp `status` reads; inside a repository every target is preflighted (safewrite)."""
     os.makedirs(dirpath, exist_ok=True)
     for name, body in GIT_HOOK_BODIES.items():
-        p = os.path.join(dirpath, name)
-        with open(p, "w") as fh:
-            fh.write(body)
-        os.chmod(p, 0o755)  # noqa: S103  # nosec B103 - git runs hooks as the invoking user; must be executable
+        p = check_target(os.path.join(dirpath, name), root)
+        write_if_changed(p, body, mode=0o755)  # nosec B103 - git runs hooks as the invoking user
     return os.path.join(dirpath, "prepare-commit-msg")
 
 
@@ -588,15 +588,15 @@ def install_repo(repo: str, cmd_prefix: str = "gitvow", agent: str = "claude") -
     pol = os.path.join(base, "policy.json")
     if not os.path.exists(pol):
         shutil.copy(DEFAULT_POLICY_PATH, pol)
-    _write_git_hook(os.path.join(base, "git-hooks"))
+    _write_git_hook(os.path.join(base, "git-hooks"), root=repo)
     ext = None if agent in AGENT_FILES else _external(agent)
     repo_rel = AGENT_FILES[agent][1] if agent in AGENT_FILES else _external_files(ext[1])[1]  # type: ignore[index]
     if agent == "claude":
-        merge_settings(os.path.join(repo, ".claude", "settings.json"), cmd_prefix)
+        merge_settings(os.path.join(repo, ".claude", "settings.json"), cmd_prefix, root=repo)
     elif ext:
-        merge_external_settings(os.path.join(repo, repo_rel), ext[1], cmd_prefix)
+        merge_external_settings(os.path.join(repo, repo_rel), ext[1], cmd_prefix, root=repo)
     else:
-        merge_agent_settings(os.path.join(repo, repo_rel), agent, cmd_prefix)
+        merge_agent_settings(os.path.join(repo, repo_rel), agent, cmd_prefix, root=repo)
     git(["config", "core.hooksPath", ".gitvow/git-hooks"], repo)
     _set_notes_config(repo, [])
     _exclude_local_sinks(repo)

gitvow-0.26.0/src/gitvow/paths.py

@@ -0,0 +1,113 @@
+"""Paths that hold credentials, kept out of everything gitvow stores.
+
+Redaction works on values and is best effort by construction. This list works on paths and is exact: a file
+whose path says it is a credential store is never snapshotted, never kept as an attribution blob, and never
+quoted, whatever its content. It is loaded *after* the repository's own settings and only ever adds
+exclusions, so a policy can extend it and cannot switch it off; a repository that wants a checked-in
+`.env.example` captured renames it, which is the honest fix.
+
+Classification is by path, never by content: a secret in `deploy/prod-values.yaml` is not covered here and is
+the redaction layer's problem. Public halves (`.crt`, `.cer`, `.pub`) are deliberately not listed, and source
+under `internal/secrets/` stays visible because only configuration-shaped files under a `secrets/` or
+`credentials/` directory are excluded.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import posixpath
+
+# basenames, matched case-insensitively at any depth
+BASENAMES: tuple[str, ...] = (
+    ".env",
+    ".env.*",
+    ".envrc",
+    ".npmrc",
+    ".netrc",
+    "_netrc",
+    ".pgpass",
+    ".htpasswd",
+    ".pypirc",
+    ".dockercfg",
+    ".boto",
+    ".git-credentials",
+    "credentials",
+    "credentials.json",
+    "credentials.yml",
+    "credentials.yaml",
+    "credentials.ini",
+    "credentials.toml",
+    "credentials.tfrc.json",
+    "application_default_credentials.json",
+    "secrets.json",
+    "secrets.yml",
+    "secrets.yaml",
+    "secrets.ini",
+    "secrets.toml",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+)
+# suffixes for key material and encrypted stores
+SUFFIXES: tuple[str, ...] = (
+    ".pem",
+    ".key",
+    ".pfx",
+    ".p12",
+    ".pkcs12",
+    ".jks",
+    ".keystore",
+    ".truststore",
+    ".ppk",
+    ".kdbx",
+    ".asc",
+    ".gpg",
+)
+# well-known relative locations, matched as the trailing path components
+LOCATIONS: tuple[str, ...] = (".docker/config.json", ".kube/config", ".aws/credentials")
+# configuration-shaped files under a directory named secrets/ or credentials/, at any depth
+SECRET_DIRS: tuple[str, ...] = ("secrets", "credentials")
+CONFIG_SUFFIXES: tuple[str, ...] = (
+    ".yaml",
+    ".yml",
+    ".json",
+    ".ini",
+    ".toml",
+    ".cfg",
+    ".conf",
+    ".properties",
+    ".txt",
+    ".enc",
+)
+
+
+def is_credential_path(path: str) -> bool:
+    """True when `path` (repository-relative or absolute, any separator) names a credential store."""
+    p = path.replace("\\", "/").strip("/").lower()
+    if not p:
+        return False
+    base = posixpath.basename(p)
+    if any(fnmatch.fnmatchcase(base, pat) for pat in BASENAMES):
+        return True
+    if base.endswith(SUFFIXES):
+        return True
+    if any(p == loc or p.endswith("/" + loc) for loc in LOCATIONS):
+        return True
+    parts = p.split("/")
+    return len(parts) > 1 and any(d in SECRET_DIRS for d in parts[:-1]) and base.endswith(CONFIG_SUFFIXES)
+
+
+def pathspec_excludes() -> list[str]:
+    """The same list as git pathspec globs, for snapshots. Basenames and suffixes at any depth."""
+    out: list[str] = []
+    for pat in BASENAMES:
+        out += [pat, f"**/{pat}"]
+    for suf in SUFFIXES:
+        out += [f"*{suf}", f"**/*{suf}"]
+    for loc in LOCATIONS:
+        out += [loc, f"**/{loc}"]
+    for d in SECRET_DIRS:
+        for suf in CONFIG_SUFFIXES:
+            out += [f"{d}/**/*{suf}", f"**/{d}/**/*{suf}", f"{d}/*{suf}", f"**/{d}/*{suf}"]
+    return out

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/rules.py

@@ -490,7 +490,10 @@ def write_section(path: str, block: str) -> str:
         action = "added"
     else:
         return "nothing to write"
-    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
-    with open(path, "w") as fh:
-        fh.write(new)
+    from .safewrite import check_target, write_if_changed
+    from .state import toplevel
+
+    target = check_target(path, toplevel(os.path.dirname(path) or "."))
+    if not write_if_changed(target, new):
+        return f"managed section in {path} already current"
     return f"{action} managed section in {path}"

gitvow-0.26.0/src/gitvow/safewrite.py

@@ -0,0 +1,76 @@
+"""Writes into a repository that a hostile checkout cannot redirect.
+
+`install`, the rules block and the claims block all write files a repository can pre-seed: `.claude/settings.json`,
+`.gitvow/git-hooks/*`, `CLAUDE.md`, `AGENTS.md`. A committed symlink at one of those paths could aim the write at
+`.git/config`, a hook, or a file outside the checkout. Every such write goes through `check_target` first, and
+through `write_if_changed`, so a rerun that changes nothing leaves the file's bytes and its mtime alone (the
+install stamp `status` reads is a hook's mtime, so a rewrite would hide agent commits made before the rerun).
+"""
+
+from __future__ import annotations
+
+import os
+import stat
+
+
+class UnsafeTargetError(Exception):
+    """The write was refused; the message says why and nothing was written."""
+
+
+def _real(p: str) -> str:
+    return os.path.realpath(p)
+
+
+def _inside(child: str, parent: str) -> bool:
+    child, parent = _real(child), _real(parent)
+    return child == parent or child.startswith(parent.rstrip(os.sep) + os.sep)
+
+
+def _git_dir_of(root: str) -> str | None:
+    from .state import git_dir
+
+    return git_dir(root)
+
+
+def check_target(path: str, root: str | None = None) -> str:
+    """Refuse a target that is not an ordinary file location inside `root` (when given).
+
+    Refused: a path whose resolution leaves `root`; a target inside the repository's git directory (recognised
+    through `git rev-parse --git-dir`, so a relocated one counts); a target that exists and is not a regular
+    file; a regular file with more than one name (hard link), because an inode's other names cannot be read back
+    and one of them may be `.git/config`. Returns the resolved path to write.
+    """
+    resolved = _real(path)
+    if root is not None:
+        if not _inside(resolved, root):
+            raise UnsafeTargetError(f"{path} resolves outside {root}; not written")
+        gd = _git_dir_of(root)
+        if gd and _inside(resolved, gd):
+            raise UnsafeTargetError(f"{path} resolves into the git directory ({gd}); not written")
+    try:
+        st = os.lstat(resolved)
+    except FileNotFoundError:
+        return resolved
+    if not stat.S_ISREG(st.st_mode):
+        raise UnsafeTargetError(f"{path} exists and is not a regular file; not written")
+    if st.st_nlink > 1:
+        raise UnsafeTargetError(f"{path} has {st.st_nlink} names (hard link); not written")
+    return resolved
+
+
+def write_if_changed(path: str, content: str, mode: int | None = None) -> bool:
+    """Write `content` to `path` only when the bytes differ. Returns True when a write happened."""
+    try:
+        with open(path) as fh:
+            if fh.read() == content:
+                if mode is not None and (os.stat(path).st_mode & 0o777) != mode:
+                    os.chmod(path, mode)
+                return False
+    except OSError:
+        pass
+    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+    with open(path, "w") as fh:
+        fh.write(content)
+    if mode is not None:
+        os.chmod(path, mode)
+    return True

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/snapshots.py

@@ -22,8 +22,19 @@ DEFAULTS: dict[str, Any] = {
 
 
 def settings(pol: dict[str, Any] | None) -> dict[str, Any]:
+    """Policy settings over the defaults. `exclude` is a union: the built-in credential-store paths (paths.py)
+    and the defaults are always excluded, and a policy can only add to them."""
+    from .paths import pathspec_excludes
+
     out = dict(DEFAULTS)
-    out.update((pol or {}).get("snapshots") or {})
+    user = dict((pol or {}).get("snapshots") or {})
+    extra = user.pop("exclude", None) or []
+    out.update(user)
+    seen: list[str] = []
+    for pat in [*DEFAULTS["exclude"], *pathspec_excludes(), *extra]:
+        if pat not in seen:
+            seen.append(pat)
+    out["exclude"] = seen
     return out
 
 

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow/status.py

@@ -22,7 +22,7 @@ from .install import (
 )
 from .policy import PolicyError, load_policy
 from .redact import RedactionError, load_rules
-from .state import git, git_dir, toplevel
+from .state import git, git_dir, load_state, toplevel
 
 Check = tuple[str, str, str]  # (state: ok|fail|note, what, fix or detail)
 
@@ -222,3 +222,52 @@ def render(checks: list[Check]) -> str:
     else:
         lines += ["", f"The record is live here.{tail}"]
     return "\n".join(lines) + "\n"
+
+
+def badge(cwd: str) -> str:
+    """One line for an agent's status bar: what the record holds for the session active in this repository.
+
+    Read from the repository's session state and hook log only, so it costs one file read and one scan and
+    makes no network call. Counts are labelled for what they are: `decided` is findings a person answered,
+    `recorded` is findings the gate put on the card or observed without asking anyone, `open` is findings
+    still waiting for an answer, `asked` is the questions a person actually got, `denied` is refused calls.
+    A repository with no session says so instead of printing zeros that look like a clean record.
+    """
+    from . import __version__
+
+    top = toplevel(cwd)
+    if not top:
+        return f"[gitvow {__version__}] not a repository"
+    st = load_state(top)
+    sid = st.get("session_id")
+    if not sid:
+        return f"[gitvow {__version__}] no session recorded here"
+    findings = list(st.get("findings") or []) + list((st.get("last_commit") or {}).get("findings") or [])
+    decided = sum(1 for f in findings if f.get("decision"))
+    open_ = sum(1 for f in findings if not f.get("decision") and not f.get("observe") and not f.get("immediate"))
+    asked = denied = recorded = 0
+    gd = git_dir(top)
+    log = os.path.join(gd, "gitvow-hooks.log") if gd else ""
+    if log and os.path.exists(log):
+        import json
+
+        with open(log) as fh:
+            for ln in fh:
+                try:
+                    ev = json.loads(ln)
+                except ValueError:
+                    continue
+                if ev.get("session_id") not in (None, sid):
+                    continue
+                k = ev.get("kind")
+                if k in ("confirm_required", "card"):
+                    asked += 1
+                elif k in ("finding", "observed"):
+                    recorded += 1
+                elif k == "blocked":
+                    denied += 1
+    parts = [f"{decided} decided", f"{recorded} recorded", f"{open_} open", f"{asked} asked", f"{denied} denied"]
+    touched = len(st.get("repos_touched") or [])
+    if touched:
+        parts.append(f"{touched} other repo{'s' if touched != 1 else ''}")
+    return f"[gitvow {__version__}] " + " · ".join(parts)

{gitvow-0.24.0 → gitvow-0.26.0/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.24.0
+Version: 0.26.0
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.24.0 → gitvow-0.26.0}/src/gitvow.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ src/gitvow/digest.py
 src/gitvow/export.py
 src/gitvow/install.py
 src/gitvow/pack.py
+src/gitvow/paths.py
 src/gitvow/policy.py
 src/gitvow/pricing.py
 src/gitvow/proposals.py
@@ -21,6 +22,7 @@ src/gitvow/recall.py
 src/gitvow/redact.py
 src/gitvow/report.py
 src/gitvow/rules.py
+src/gitvow/safewrite.py
 src/gitvow/scan.py
 src/gitvow/selftest.py
 src/gitvow/snapshots.py
@@ -44,6 +46,7 @@ tests/test_digest.py
 tests/test_e2e_globalopt.py
 tests/test_export.py
 tests/test_external_adapter.py
+tests/test_hardening.py
 tests/test_hooks.py
 tests/test_install_cli.py
 tests/test_pack.py

gitvow-0.26.0/tests/test_hardening.py

@@ -0,0 +1,117 @@
+"""0.26: credential-store paths, safe writes, write-if-changed, the status badge."""
+
+import json
+import os
+import time
+
+import pytest
+
+from gitvow import paths, snapshots
+from gitvow.hooks import post_tool_use, pre_tool_use, session_start
+from gitvow.install import _write_git_hook, install_repo
+from gitvow.safewrite import UnsafeTargetError, check_target, write_if_changed
+from gitvow.status import badge
+
+FORCE_PUSH = "git push " + "--force"  # split so the gate reading this repository's own tool calls does not trip
+
+
+@pytest.mark.parametrize(
+    "p",
+    [
+        ".env",
+        "app/.env.production",
+        "deploy/.npmrc",
+        "~/.aws/credentials",
+        "ops/credentials.json",
+        "k8s/secrets/db.yaml",
+        "infra/credentials/prod.toml",
+        "certs/server.pem",
+        "keys/id_ed25519",
+        ".docker/config.json",
+        "home/.kube/config",
+        "vault.kdbx",
+    ],
+)
+def test_credential_paths_are_recognised(p):
+    assert paths.is_credential_path(p)
+
+
+@pytest.mark.parametrize(
+    "p", ["deploy/prod-values.yaml", "internal/secrets/store.go", "certs/server.crt", "id_ed25519.pub", "README.md", ""]
+)
+def test_ordinary_paths_are_not(p):
+    assert not paths.is_credential_path(p)
+
+
+def test_snapshot_exclusions_are_a_union_the_policy_cannot_shrink():
+    cfg = snapshots.settings({"snapshots": {"exclude": ["*.sqlite"]}})
+    assert "*.sqlite" in cfg["exclude"] and ".env*" in cfg["exclude"] and "**/*.pem" in cfg["exclude"]
+    assert snapshots.settings({"snapshots": {"exclude": []}})["exclude"] == snapshots.settings(None)["exclude"]
+
+
+def test_agent_blob_is_never_kept_for_a_credential_path(repo, home, payload):
+    session_start(payload("SessionStart"), str(home))
+    (repo / ".npmrc").write_text("//registry/:_authToken=abc\n")
+    (repo / "b.txt").write_text("b\n")
+    post_tool_use(payload("PostToolUse", "Write", {"file_path": str(repo / ".npmrc")}), str(home))
+    post_tool_use(payload("PostToolUse", "Write", {"file_path": str(repo / "b.txt")}), str(home))
+    st = json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    assert set(st["agent_blobs"]) == {"b.txt"}
+    assert '"kind": "blob_skipped"' in (repo / ".git" / "gitvow-hooks.log").read_text()
+
+
+def test_check_target_refuses_escapes_git_dir_and_hard_links(repo, tmp_path):
+    outside = tmp_path / "outside.json"
+    outside.write_text("{}")
+    (repo / ".claude").mkdir()
+    os.symlink(outside, repo / ".claude" / "settings.json")
+    with pytest.raises(UnsafeTargetError, match="outside"):
+        check_target(str(repo / ".claude" / "settings.json"), str(repo))
+    os.remove(repo / ".claude" / "settings.json")
+    os.symlink(repo / ".git" / "config", repo / ".claude" / "settings.json")
+    with pytest.raises(UnsafeTargetError, match="git directory"):
+        check_target(str(repo / ".claude" / "settings.json"), str(repo))
+    os.remove(repo / ".claude" / "settings.json")
+    os.link(repo / ".git" / "config", repo / "CLAUDE.md")
+    with pytest.raises(UnsafeTargetError, match="hard link"):
+        check_target(str(repo / "CLAUDE.md"), str(repo))
+    os.remove(repo / "CLAUDE.md")
+    (repo / "adir").mkdir()
+    with pytest.raises(UnsafeTargetError, match="not a regular file"):
+        check_target(str(repo / "adir"), str(repo))
+    assert check_target(str(repo / "AGENTS.md"), str(repo)) == os.path.realpath(repo / "AGENTS.md")
+
+
+def test_repo_install_refuses_a_redirected_settings_file(repo, home, tmp_path):
+    outside = tmp_path / "elsewhere.json"
+    outside.write_text("{}")
+    (repo / ".claude").mkdir()
+    os.symlink(outside, repo / ".claude" / "settings.json")
+    with pytest.raises(UnsafeTargetError):
+        install_repo(str(repo))
+    assert outside.read_text() == "{}"
+
+
+def test_rerun_leaves_unchanged_hooks_untouched(repo, home):
+    d = str(repo / ".gitvow" / "git-hooks")
+    stamp = _write_git_hook(d, root=str(repo))
+    before = os.stat(stamp).st_mtime_ns
+    time.sleep(0.01)
+    _write_git_hook(d, root=str(repo))
+    assert os.stat(stamp).st_mtime_ns == before
+    assert oct(os.stat(stamp).st_mode & 0o777) == "0o755"
+    assert write_if_changed(str(repo / "x.txt"), "a") and not write_if_changed(str(repo / "x.txt"), "a")
+
+
+def test_badge_reads_the_session_state_and_log(repo, home, payload, tmp_path):
+    assert badge(str(tmp_path)).endswith("not a repository")
+    assert badge(str(repo)).endswith("no session recorded here")
+    session_start(payload("SessionStart"), str(home))
+    (repo / "values" / "production-in").mkdir(parents=True)
+    target = repo / "values" / "production-in" / "app.yaml"
+    target.write_text("replicas: 1\n")
+    pre_tool_use(payload("PreToolUse", "Edit", {"file_path": str(target)}), str(home))
+    code, _ = pre_tool_use(payload("PreToolUse", "Bash", {"command": FORCE_PUSH}), str(home))
+    assert code == 2
+    line = badge(str(repo))
+    assert "0 decided" in line and "1 recorded" in line and "1 open" in line and "1 denied" in line

{gitvow-0.24.0 → gitvow-0.26.0}/tests/test_hooks.py

@@ -262,3 +262,67 @@ def test_plumbing_that_merely_starts_with_commit_is_not_a_commit():
 
     for cmd in ("git commit-tree $t", "git commit-graph write", "git log --format=%H", "gitk commitish"):
         assert not COMMIT_RE.search(cmd), cmd
+
+
+def _other_repo(tmp_path, home, name="other"):
+    o = tmp_path / name
+    o.mkdir()
+    git(o, "init", "-q")
+    git(o, "config", "user.email", "t@test")
+    git(o, "config", "user.name", "t")
+    (o / "b.txt").write_text("b\n")
+    git(o, "add", "b.txt")
+    git(o, "commit", "-qm", "init")
+    _commit_hooked(o, home)
+    return o
+
+
+def test_edit_into_another_repository_is_gated_and_recorded_there(repo, home, payload, tmp_path):
+    other = _other_repo(tmp_path, home)
+    (other / "values" / "production-in").mkdir(parents=True)
+    target = other / "values" / "production-in" / "app.yaml"
+    target.write_text("replicas: 1\n")
+    session_start(payload("SessionStart"), str(home))
+    code, _ = pre_tool_use(payload("PreToolUse", "Edit", {"file_path": str(target)}), str(home))
+    assert code == 0  # a commit-tier finding: recorded, the edit runs
+    there = json.loads((other / ".git" / "gitvow-session.json").read_text())
+    assert [f["reason"] for f in there["findings"]] == ["edits production GitOps values"]
+    here = json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    assert not here.get("findings") and here["repos_touched"] == [str(other)]
+    post_tool_use(payload("PostToolUse", "Edit", {"file_path": str(target)}), str(home))
+    assert (
+        "values/production-in/app.yaml"
+        in json.loads((other / ".git" / "gitvow-session.json").read_text())["agent_blobs"]
+    )
+
+
+def test_git_dash_c_commit_in_another_repository_gets_trailers_and_note(repo, home, payload, tmp_path, transcript):
+    other = _other_repo(tmp_path, home)
+    session_start(payload("SessionStart"), str(home))
+    cmd = {"command": f"git -C {other} commit -am x"}
+    assert pre_tool_use(payload("PreToolUse", "Bash", cmd, transcript), str(home))[0] == 0
+    assert "pending_commit" in json.loads((other / ".git" / "gitvow-session.json").read_text())
+    assert "pending_commit" not in json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    (other / "b.txt").write_text("changed\n")
+    git(other, "commit", "-qam", "feature")
+    assert "Gitvow-Session: sess-1" in git(other, "log", "-1", "--format=%B")
+    code, msg = post_tool_use(payload("PostToolUse", "Bash", cmd, transcript), str(home))
+    assert code == 0 and "session note attached" in msg
+    assert git(other, "notes", "--ref=gitvow/sess-1", "show", "HEAD").startswith("gitvow-session")
+    assert git(repo, "for-each-ref", "refs/notes/") == ""
+
+
+def test_cd_then_commit_targets_that_repository(repo, home, payload, tmp_path):
+    other = _other_repo(tmp_path, home)
+    session_start(payload("SessionStart"), str(home))
+    pre_tool_use(payload("PreToolUse", "Bash", {"command": f"cd {other} && git commit -m x"}), str(home))
+    assert "pending_commit" in json.loads((other / ".git" / "gitvow-session.json").read_text())
+
+
+def test_paths_outside_any_repository_fall_back_to_the_session(repo, home, payload, tmp_path):
+    from gitvow.hooks import target_cwd
+
+    assert target_cwd("Edit", {"file_path": str(tmp_path / "nowhere" / "x.txt")}, str(repo)) == str(repo)
+    assert target_cwd("Edit", {"file_path": str(repo / "sub" / "new.txt")}, str(repo)) == str(repo)
+    assert target_cwd("Bash", {"command": "git commit -m x"}, str(repo)) == str(repo)
+    assert target_cwd("Bash", {"command": f"git -C {repo} commit -m x"}, str(repo)) == str(repo)

{gitvow-0.24.0 → gitvow-0.26.0}/tests/test_tiers.py

@@ -212,10 +212,7 @@ def test_edits_in_another_checkout_are_counted_and_named(repo, home, payload, tr
     assert st["edits_elsewhere"] == {"other-repo": {"count": 2, "paths": ["svc/main.go"]}}
     assert "here.txt" in st["agent_blobs"] and "svc/main.go" not in st["agent_blobs"]
     card = dec.card(str(repo), for_agent=False)
-    assert (
-        "Edits outside this repository: 2 in other-repo" in card
-        and "recorded in this repository's note, not in theirs" in card
-    )
+    assert "Edits outside this repository: 2 in other-repo" in card and "gated by that repository's own policy" in card
     _hooks(repo)
     git(repo, "add", "here.txt")
     pre_tool_use(payload("PreToolUse", "Bash", {"command": "git commit -m x"}, transcript), str(home))