gitvow 0.28.0__tar.gz → 0.28.2__tar.gz

{gitvow-0.28.0/src/gitvow.egg-info → gitvow-0.28.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.28.0
+Version: 0.28.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.28.0 → gitvow-0.28.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.28.0"
+version = "0.28.2"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow/default_policy.json

@@ -6,11 +6,19 @@
       "reason": "recursive delete of root/home"
     },
     {
-      "pattern": "\\bgit\\s+push\\b.*(--force|-f\\b|\\+refs)",
+      "program": "git",
+      "verbs": [
+        "push\\b.*?(?:--force|\\s-f\\b|\\+refs)"
+      ],
       "reason": "force push"
     },
     {
-      "pattern": "\\bgit\\s+(reset\\s+--hard|clean\\s+-fd|branch\\s+-D)\\b",
+      "program": "git",
+      "verbs": [
+        "reset\\s+--hard",
+        "clean\\s+-fd",
+        "branch\\s+-D"
+      ],
       "reason": "destructive git history/worktree operation"
     },
     {
@@ -48,8 +56,20 @@
   ],
   "bash_confirm": [
     {
-      "pattern": "\\bgit\\s+push\\b",
-      "reason": "pushing to a remote"
+      "program": "git",
+      "verbs": [
+        "push"
+      ],
+      "target": "branch=(main|master|production|release[^ ]*)$",
+      "reason": "pushing to a protected branch"
+    },
+    {
+      "program": "git",
+      "verbs": [
+        "push"
+      ],
+      "reason": "pushing to a remote",
+      "when": "observe"
     },
     {
       "program": "kubectl",
@@ -154,7 +174,9 @@
     "rule_decay_days": 90,
     "_doc": "rule_threshold: consistent answers by authorities before a finding becomes an earned rule; rule_decay_days: days without a new confirmation before it lapses. mode: open (the agent's commit is stopped once with the card, then goes through with Gitvow-Open for every finding nobody answered; a person's commit goes through the same way) or strict (agent and person alike: refused until every finding has a gitvow decide answer). authorities: emails, email local parts or names whose decisions count; empty means anyone with commit access. session_scope: an immediate confirm is recorded as a finding and a person's yes (gitvow decide <n> accept --scope session, or the agent's own approve button) holds for the rest of the session; the next commit carries it as a scoped decision, which is never precedent. false: ask every time, record nothing.",
     "session_scope": true,
-    "indirect_commands": "observe"
+    "indirect_commands": "observe",
+    "commit_window_seconds": 1800,
+    "_doc_commit_window": "How long after the gate sees the agent's `git commit` the git hooks still treat the commit as the agent's and write its trailers. Guards against a stale flag catching a person's later commit; too short and a harness that queues tool calls loses trailers. When a commit lands past the window, PostToolUse says so and logs commit_without_trailer."
   },
   "llm_classifier": {
     "enabled": false,

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow/hooks/__init__.py

@@ -239,6 +239,10 @@ def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
         st["transcript_path"] = h.get("transcript_path") or st.get("transcript_path")
         st["steps"] = st.get("steps", 0) + 1
         st["pending_commit"] = time.time()  # the git hook adds trailers only while this is fresh
+        # How long "fresh" is. Five minutes was the original guard against a stale flag catching a person's
+        # later commit; a harness that queues tool calls can run the agent's commit well after the gate saw it,
+        # and one of our own release commits lost its trailer to a seven-minute queue. The window is policy.
+        st["pending_ttl"] = int((pol.get("decisions") or {}).get("commit_window_seconds", 1800))
         save_state(cwd, st)
     if rules is None:
         log_event(cwd, "allowed", {"tool": tool})
@@ -400,6 +404,7 @@ def post_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]
     if tool != "Bash":
         return 0, ""
     st = load_state(cwd)
+    pending_at = st.get("pending_commit")
     if "pending_commit" in st or "card_ack" in st:
         st.pop("pending_commit", None)
         st.pop("card_ack", None)  # the commit happened; the next set of findings earns its own card
@@ -413,7 +418,20 @@ def post_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]
     summ = summarize(h.get("transcript_path") or st.get("transcript_path"), rules=rules)
     _, head_msg, _ = git(["log", "-1", "--format=%B", head], cwd)
     if "Gitvow-Session:" not in head_msg:
-        return 0, ""  # the commit did not go through (or was not the agent's): no note
+        # The commit did not go through, was not the agent's, or landed after the window closed. The last case
+        # is a silent hole in the record unless said out loud, so measure it and say it.
+        rc, cts, _ = git(["log", "-1", "--format=%ct", head], cwd)
+        if pending_at and rc == 0 and cts.isdigit() and int(cts) >= int(pending_at):
+            gap = int(cts) - int(pending_at)
+            window = int(st.get("pending_ttl") or 300)
+            if gap >= window:
+                log_event(cwd, "commit_without_trailer", {"commit": head[:12], "gap_seconds": gap, "window": window})
+                return 0, (
+                    f"gitvow: commit {head[:12]} landed {gap}s after the gate saw the commit command, past the "
+                    f"{window}s window, so it carries no session trailer and no note. Raise "
+                    f"decisions.commit_window_seconds if your agent queues tool calls this long."
+                )
+        return 0, ""
     _, files, _ = git(["show", "--stat", "--format=", head], cwd)
     attribution = _attribution(cwd, head, st.get("agent_blobs", {}), summ["files_written"])
     session_id = h.get("session_id") or st.get("session_id")

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow/install.py

@@ -17,7 +17,10 @@ GD="$(git rev-parse --git-dir)"; STATE="$GD/gitvow-session.json"
 if [ -f "$STATE" ]; then
   # Trailers go only on commits the agent itself runs: the PreToolUse gate sets pending_commit when the
   # agent invokes git commit and PostToolUse clears it. A human commit in a terminal gets no trailer.
-  SID=$(python3 -c "import json,time;s=json.load(open('$STATE'));p=s.get('pending_commit') or 0;print(s.get('session_id') or '' if time.time()-p<300 else '')" 2>/dev/null)
+  # The window is written into the state by the gate from decisions.commit_window_seconds (default 1800): a
+  # harness that queues tool calls can run the commit minutes after the gate saw it. Older states carry no
+  # window and keep the original five minutes.
+  SID=$(python3 -c "import json,time;s=json.load(open('$STATE'));p=s.get('pending_commit') or 0;w=s.get('pending_ttl') or 300;print(s.get('session_id') or '' if time.time()-p<w else '')" 2>/dev/null)
   STEP=$(python3 -c "import json;print(json.load(open('$STATE')).get('steps') or 0)" 2>/dev/null)
   if [ -n "$SID" ] && ! grep -q "^Gitvow-Session:" "$1"; then printf "\\nGitvow-Session: %s\\nGitvow-Step: %s\\n" "$SID" "$STEP" >> "$1"; fi
   # Decisions recorded with `gitvow decide` become Gitvow-Accepted/Declined/Referred trailers; findings nobody
@@ -72,7 +75,7 @@ st = json.load(open(sys.argv[1]))
 open_ = [f for f in st.get("findings") or [] if not f.get("decision") and not f.get("observe") and not f.get("immediate")]
 if not open_:
     sys.exit(0)
-fresh = time.time() - (st.get("pending_commit") or 0) < 300  # the agent's own commit: the gate already asked
+fresh = time.time() - (st.get("pending_commit") or 0) < (st.get("pending_ttl") or 300)  # the agent's own commit
 if fresh:
     sys.exit(0)
 mode = "open"

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow/policy.py

@@ -295,7 +295,7 @@ def _validate(pol: dict[str, Any], path: str) -> None:
     for key in ("authorities", "production_branches"):
         if not isinstance(dec.get(key, []), list):
             raise PolicyError(f"{path}: decisions.{key} must be a list")
-    for key in ("rule_threshold", "rule_decay_days"):
+    for key in ("rule_threshold", "rule_decay_days", "commit_window_seconds"):
         v = dec.get(key, 1)
         if not isinstance(v, int) or isinstance(v, bool) or v < 1:
             raise PolicyError(f"{path}: decisions.{key} must be a positive integer")

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow/targets.py

@@ -106,8 +106,17 @@ def resolve(prog: str, args: list[str], cwd: str | None, env: dict[str, str] | N
             return kubectl(args, env)
         if prog == "helm":
             return helm(args, env)
-        if prog == "git" and args and args[0] == "push":
-            return git_push(args[1:], cwd)
+        if prog == "git":
+            # step over git's own options (`-C dir`, `-c k=v`, `--git-dir=…`) to the subcommand
+            i = 0
+            while i < len(args) and args[i].startswith("-"):
+                i += 2 if args[i] in ("-C", "-c", "--git-dir", "--work-tree", "--namespace") else 1
+            if i < len(args) and args[i] == "push":
+                repo_dir = None
+                for j in range(0, i):
+                    if args[j] == "-C" and j + 1 < len(args):
+                        repo_dir = args[j + 1]
+                return git_push(args[i + 1 :], repo_dir if repo_dir and os.path.isdir(repo_dir) else cwd)
         if prog in ("terraform", "tofu"):
             return terraform(args, cwd)
     except Exception:  # a target resolver must never take the gate down; None asks

{gitvow-0.28.0 → gitvow-0.28.2/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.28.0
+Version: 0.28.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.28.0 → gitvow-0.28.2}/src/gitvow.egg-info/SOURCES.txt

@@ -43,12 +43,14 @@ tests/test_adapters.py
 tests/test_claims.py
 tests/test_collect.py
 tests/test_command_position.py
+tests/test_commit_window.py
 tests/test_cost.py
 tests/test_decisions.py
 tests/test_digest.py
 tests/test_e2e_globalopt.py
 tests/test_export.py
 tests/test_external_adapter.py
+tests/test_git_rules.py
 tests/test_hardening.py
 tests/test_hooks.py
 tests/test_install_cli.py

gitvow-0.28.2/tests/test_commit_window.py

@@ -0,0 +1,59 @@
+"""0.28.1: the pending-commit window is policy, and a commit that lands past it is said out loud."""
+
+import json
+import time
+
+from gitvow.hooks import post_tool_use, pre_tool_use, session_start
+from gitvow.install import _write_git_hook
+from tests.conftest import git
+
+
+def _hooked(repo):
+    _write_git_hook(str(repo / ".gitvow" / "git-hooks"))
+    git(repo, "config", "core.hooksPath", ".gitvow/git-hooks")
+
+
+def test_window_comes_from_policy_and_old_states_keep_five_minutes(repo, home, payload):
+    _hooked(repo)
+    session_start(payload("SessionStart"), str(home))
+    pre_tool_use(payload("PreToolUse", "Bash", {"command": "git commit -m x"}), str(home))
+    p = repo / ".git" / "gitvow-session.json"
+    st = json.loads(p.read_text())
+    assert st["pending_ttl"] == 1800
+    # ten minutes ago is inside the default window: the trailer is written
+    st["pending_commit"] = time.time() - 600
+    p.write_text(json.dumps(st))
+    (repo / "a.txt").write_text("1\n")
+    git(repo, "commit", "-qam", "queued ten minutes")
+    assert "Gitvow-Session: sess-1" in git(repo, "log", "-1", "--format=%B")
+    # a state written by an older gitvow has no window and keeps the original five minutes
+    st = json.loads(p.read_text())
+    st["pending_commit"] = time.time() - 600
+    st.pop("pending_ttl", None)
+    p.write_text(json.dumps(st))
+    (repo / "a.txt").write_text("2\n")
+    git(repo, "commit", "-qam", "old state, ten minutes")
+    assert "Gitvow-Session" not in git(repo, "log", "-1", "--format=%B")
+
+
+def test_a_commit_past_the_window_is_reported_and_logged(repo, home, payload, monkeypatch, tmp_path):
+    _hooked(repo)
+    pol = tmp_path / "policy.json"
+    from gitvow.policy import DEFAULT_POLICY_PATH
+
+    with open(DEFAULT_POLICY_PATH) as fh:
+        d = json.load(fh)
+    d["decisions"]["commit_window_seconds"] = 1
+    (repo / ".gitvow").mkdir(exist_ok=True)
+    (repo / ".gitvow" / "policy.json").write_text(json.dumps(d))
+    session_start(payload("SessionStart"), str(home))
+    pre_tool_use(payload("PreToolUse", "Bash", {"command": "git commit -m x"}), str(home))
+    assert json.loads((repo / ".git" / "gitvow-session.json").read_text())["pending_ttl"] == 1
+    time.sleep(1.2)
+    (repo / "a.txt").write_text("late\n")
+    git(repo, "commit", "-qam", "late commit")
+    assert "Gitvow-Session" not in git(repo, "log", "-1", "--format=%B")
+    code, msg = post_tool_use(payload("PostToolUse", "Bash", {"command": "git commit -m x"}), str(home))
+    assert code == 0 and "past the 1s window" in msg and "carries no session trailer" in msg
+    assert '"kind": "commit_without_trailer"' in (repo / ".git" / "gitvow-hooks.log").read_text()
+    assert pol is not None

gitvow-0.28.2/tests/test_git_rules.py

@@ -0,0 +1,56 @@
+"""0.28.2: the git rules are program rules, so `git -C <dir> push` and `git -c k=v push` are seen.
+
+Found by dogfooding: every push made through `git -C <repo> push` on 2026-09-22 walked past the `pattern` rule
+`\\bgit\\s+push\\b`, which needed the two words adjacent. Same bug class the kubectl rules had until 0.17.1.
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from gitvow.policy import DEFAULT_POLICY_PATH, evaluate
+from tests.conftest import git
+
+C = "/Users/someone/work/repo"
+
+
+@pytest.fixture
+def pol():
+    return json.loads(Path(DEFAULT_POLICY_PATH).read_text())
+
+
+@pytest.mark.parametrize(
+    "cmd",
+    [
+        "git push --force origin main",
+        "git push -f",
+        f"git -C {C} push -q -f origin v0.26",
+        f"git -C {C} push --force-with-lease origin main",
+        "git -c user.name=x push +refs/heads/main",
+        f"git -C {C} reset --hard HEAD~1",
+        f"git -C {C} clean -fd",
+        "git branch -D feature",
+    ],
+)
+def test_destructive_git_is_denied_whatever_sits_between_git_and_the_verb(pol, cmd):
+    assert evaluate(pol, "Bash", {"command": cmd}).outcome == "deny", cmd
+
+
+def test_a_push_to_a_protected_branch_asks_and_other_pushes_are_observed(repo, home, pol):
+    git(repo, "remote", "add", "origin", "git@example.com:acme/ledger.git")
+    d = evaluate(pol, "Bash", {"command": f"git -C {repo} push -q origin main"}, str(repo))
+    assert d.outcome == "confirm" and d.when == "immediate" and d.reason == "pushing to a protected branch"
+    assert d.findings[0]["finding"].endswith("@ remote=git@example.com:acme/ledger.git branch=main")
+    d = evaluate(pol, "Bash", {"command": "git push origin feature/x"}, str(repo))
+    assert d.outcome == "confirm" and d.when == "observe" and d.reason == "pushing to a remote"
+    d = evaluate(pol, "Bash", {"command": "git push origin HEAD:refs/heads/release-2"}, str(repo))
+    assert d.when == "immediate"
+    # a push whose destination cannot be read (no such remote) is asked about
+    d = evaluate(pol, "Bash", {"command": "git push nowhere feature/x"}, str(repo))
+    assert d.when == "immediate"
+
+
+def test_mentions_of_push_inside_arguments_are_not_pushes(pol):
+    assert evaluate(pol, "Bash", {"command": 'git commit -m "docs: how to git push safely"'}).outcome == "allow"
+    assert evaluate(pol, "Bash", {"command": "echo 'git push --force is denied' >> notes.md"}).outcome == "allow"

{gitvow-0.28.0 → gitvow-0.28.2}/tests/test_tiers.py

@@ -105,10 +105,14 @@ def test_immediate_confirm_is_answered_once_per_session(repo, home, payload, tra
     session_start(payload("SessionStart"), str(home))
     push = payload("PreToolUse", "Bash", {"command": "git push origin feat"}, transcript)
     code, msg = pre_tool_use(push, str(home))
-    assert code == 2 and msg.startswith("CONFIRMATION REQUIRED (pushing to a remote)")
+    assert code == 2 and msg.startswith("CONFIRMATION REQUIRED (pushing to a protected branch)")
     assert "gitvow decide 1 accept --scope session" in msg and "gitvow decide 1 decline" in msg
     fs = dec.open_findings(str(repo))
-    assert fs[0]["finding"] == "run git (pushing to a remote)" and fs[0]["immediate"] and fs[0]["decision"] is None
+    assert (
+        fs[0]["finding"] == "run git (pushing to a protected branch)"
+        and fs[0]["immediate"]
+        and fs[0]["decision"] is None
+    )
     # asked and never answered: not on the card, not owed
     assert dec.undecided(str(repo)) == []
     assert "No open findings" in dec.card(str(repo), for_agent=False)
@@ -130,7 +134,7 @@ def test_immediate_confirm_is_answered_once_per_session(repo, home, payload, tra
     pre_tool_use(payload("PreToolUse", "Bash", {"command": "git commit -m x"}, transcript), str(home))
     git(repo, "commit", "-qam", "after the push was allowed")
     body = git(repo, "log", "-1", "--format=%B")
-    assert "Gitvow-Accepted: run git (pushing to a remote) by t scope=session: release branch" in body
+    assert "Gitvow-Accepted: run git (pushing to a protected branch) by t scope=session: release branch" in body
     post_tool_use(payload("PostToolUse", "Bash", {"command": "git commit -m x"}, transcript), str(home))
     from gitvow.rules import derive
 
@@ -154,7 +158,7 @@ def test_declined_immediate_confirm_stays_blocked_for_the_session(repo, home, pa
     (repo / "a.txt").write_text("d\n")
     pre_tool_use(payload("PreToolUse", "Bash", {"command": "git commit -m x"}, transcript), str(home))
     git(repo, "commit", "-qam", "carries the decline")
-    assert "Gitvow-Declined: run git (pushing to a remote) by t: not from this branch" in git(
+    assert "Gitvow-Declined: run git (pushing to a protected branch) by t: not from this branch" in git(
         repo, "log", "-1", "--format=%B"
     )