gitvow 0.28.3__tar.gz → 0.28.4__tar.gz

{gitvow-0.28.3/src/gitvow.egg-info → gitvow-0.28.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.28.3
+Version: 0.28.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.28.3 → gitvow-0.28.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.28.3"
+version = "0.28.4"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.28.3 → gitvow-0.28.4}/src/gitvow/hooks/__init__.py

@@ -186,17 +186,22 @@ def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
         f = dict(d.findings[0], immediate=True)
         text = redact(f["finding"], rules) if rules is not None else f["finding"]
         prior = dec.session_answer(cwd, text)
-        if session_scope and prior and prior.get("answer") == "accepted" and prior.get("scope") == "session":
-            log_event(cwd, "allowed_by_session_answer", {**payload, "by": prior.get("by")})
-            return 0, ""
-        if prior and prior.get("answer") == "declined":
+        answered = bool(
+            session_scope and prior and prior.get("answer") == "accepted" and prior.get("scope") == "session"
+        )
+        if answered:
+            log_event(cwd, "allowed_by_session_answer", {**payload, "by": prior.get("by")})  # type: ignore[union-attr]
+            # Do not return yet: the same command may also commit (`git commit && git push`), and until 0.28.4 the
+            # early return here skipped the commit bookkeeping below, so the commit lost its session trailer.
+        elif prior and prior.get("answer") == "declined":
             log_event(cwd, "confirm_required", {**payload, "declined_by": prior.get("by")})
             return 2, f"BLOCKED: {text} was declined by {prior.get('by')} this session ({d.reason})."
-        st = load_state(cwd)
-        dec.add(cwd, [f], st.get("steps", 0) + 1, tool, rules)
-        n = next((x["n"] for x in dec.open_findings(cwd) if x["finding"] == text), None)
-        log_event(cwd, "confirm_required", {**payload, "finding": n})
-        return 2, confirm_message(d, n, session_scope)
+        if not answered:
+            st = load_state(cwd)
+            dec.add(cwd, [f], st.get("steps", 0) + 1, tool, rules)
+            n = next((x["n"] for x in dec.open_findings(cwd) if x["finding"] == text), None)
+            log_event(cwd, "confirm_required", {**payload, "finding": n})
+            return 2, confirm_message(d, n, session_scope)
     if d.deferred or d.observed:
         st = load_state(cwd)
         new = dec.add(cwd, list(d.findings), st.get("steps", 0) + 1, tool, rules)

{gitvow-0.28.3 → gitvow-0.28.4/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.28.3
+Version: 0.28.4
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.28.3 → gitvow-0.28.4}/src/gitvow.egg-info/SOURCES.txt

@@ -40,6 +40,7 @@ src/gitvow.egg-info/requires.txt
 src/gitvow.egg-info/top_level.txt
 src/gitvow/hooks/__init__.py
 tests/test_adapters.py
+tests/test_answered_confirm_commit.py
 tests/test_claims.py
 tests/test_collect.py
 tests/test_command_position.py

gitvow-0.28.4/tests/test_answered_confirm_commit.py

@@ -0,0 +1,35 @@
+"""0.28.4: a command that both commits and runs a session-answered confirm still gets its commit bookkeeping.
+
+Found on the founder's machine: after a push to main had been accepted for the session, `git commit … && git push`
+in one command was allowed by the session answer and returned before the commit flag was set, so the commit carried
+no session trailer. Three of four repositories lost the trailer on the same evening the same way.
+"""
+
+import json
+
+from gitvow import decisions as dec
+from gitvow.hooks import pre_tool_use, session_start
+from gitvow.install import _write_git_hook
+from gitvow.policy import load_policy
+from tests.conftest import git
+
+
+def test_session_answered_push_in_the_same_command_as_a_commit_keeps_the_trailer(repo, home, payload):
+    _write_git_hook(str(repo / ".gitvow" / "git-hooks"))
+    git(repo, "config", "core.hooksPath", ".gitvow/git-hooks")
+    git(repo, "remote", "add", "origin", "git@example.com:acme/ledger.git")
+    session_start(payload("SessionStart"), str(home))
+    cmd = {"command": 'git commit -qm "x" && git push origin main'}
+    code, msg = pre_tool_use(payload("PreToolUse", "Bash", cmd), str(home))
+    assert code == 2 and "pushing to a protected branch" in msg
+    dec.decide(str(repo), "1", "accept", load_policy(str(repo), str(home)), scope="session", reason="ok", rules=[])
+    code, msg = pre_tool_use(payload("PreToolUse", "Bash", cmd), str(home))
+    assert code == 0
+    st = json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    assert st.get("pending_commit") and st["steps"] == 1
+    (repo / "a.txt").write_text("y\n")
+    git(repo, "commit", "-qam", "after the answer")
+    body = git(repo, "log", "-1", "--format=%B")
+    assert "Gitvow-Session: sess-1" in body and "Gitvow-Accepted: run git (pushing to a protected branch)" in body
+    log = (repo / ".git" / "gitvow-hooks.log").read_text()
+    assert '"kind": "allowed_by_session_answer"' in log