gitvow 0.29.0__tar.gz → 0.29.2__tar.gz

{gitvow-0.29.0/src/gitvow.egg-info → gitvow-0.29.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.29.0
+Version: 0.29.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.29.0 → gitvow-0.29.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.29.0"
+version = "0.29.2"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.29.0 → gitvow-0.29.2}/src/gitvow/adapters.py

@@ -10,7 +10,7 @@ import shutil
 import subprocess
 from typing import Any
 
-from .decisions import CARD_HEADER
+from .decisions import CARD_HEADER, OPEN_CARD_HEADER
 
 AGENTS = ("claude", "codex", "gemini", "cursor", "copilot", "factory")
 
@@ -266,8 +266,47 @@ def _refuse(msg: str) -> bool:
     return msg.startswith("BLOCKED") or msg.startswith(CARD_HEADER)
 
 
-def respond(agent: str, code: int, msg: str) -> tuple[int, str, str]:
-    """(exit code, stdout, stderr) in the agent's form. gitvow's code 2 means blocked; the message says DENY or CONFIRM."""
+# Claude Code permission modes in which a native question reaches a person. In every other mode (bypass, auto,
+# dontAsk, or an agent too old to report one) an `ask` may be granted with nobody looking, and the record would then
+# say a person approved; there the verdict stays a hard block delivered to the agent, as before 0.29.2.
+PROMPTING_MODES = frozenset({"default", "acceptEdits", "plan"})
+_CONFIRM_REASON = re.compile(r"CONFIRMATION REQUIRED \((.*?)\)\.")
+
+
+def native_question(msg: str) -> str:
+    """The short reason shown in the agent's own permission dialog, in place of the terminal instructions."""
+    m = _CONFIRM_REASON.search(msg)
+    if m:
+        return (
+            f"gitvow: {m.group(1)}. Allow records your approval for this session, on the next commit, under your "
+            "git identity. Deny records nothing and stops the command."
+        )
+    if msg.startswith(OPEN_CARD_HEADER):
+        first = msg.splitlines()[0]
+        return (
+            f"gitvow: {first}. Allow commits anyway and records each finding as Gitvow-Open; Deny stops the commit so "
+            "they can be answered first with `gitvow decide`."
+        )
+    return "gitvow: " + msg.splitlines()[0][:200]
+
+
+def respond(agent: str, code: int, msg: str, mode: str | None = None) -> tuple[int, str, str]:
+    """(exit code, stdout, stderr) in the agent's form. gitvow's code 2 means blocked; the message says DENY or CONFIRM.
+
+    `mode` is Claude Code's permission mode from the hook payload. When it is one that shows prompts, a confirm
+    becomes Claude Code's own question to the person (`permissionDecision: ask`), and their click is recorded by
+    PostToolUse as a session-scoped decision, exactly as for Cursor and Copilot. Denials and the strict card are
+    never a question.
+    """
+    if agent == "claude" and code == 2 and mode in PROMPTING_MODES and not _refuse(msg):
+        out = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "ask",
+                "permissionDecisionReason": native_question(msg),
+            }
+        }
+        return 0, json.dumps(out), ""
     if agent == "cursor":
         if code == 2:
             perm = "deny" if _refuse(msg) else "ask"

{gitvow-0.29.0 → gitvow-0.29.2}/src/gitvow/cli.py

@@ -33,6 +33,7 @@ def cmd_hook(a: argparse.Namespace) -> int:
     from .adapters import AdapterError, external_normalize, external_path, external_respond
 
     agent = a.agent or "claude"
+    mode = payload.get("permission_mode") if isinstance(payload, dict) else None
     exe = external_path(agent)
     try:
         calls = external_normalize(exe, a.event, payload) if exe else normalize(agent, a.event, payload)
@@ -72,7 +73,9 @@ def cmd_hook(a: argparse.Namespace) -> int:
         return 0
     try:
         exit_code, out, err = (
-            external_respond(exe, worst, "\n".join(messages)) if exe else respond(agent, worst, "\n".join(messages))
+            external_respond(exe, worst, "\n".join(messages))
+            if exe
+            else respond(agent, worst, "\n".join(messages), mode=mode)
         )
     except AdapterError as e:
         print(f"BLOCKED: agent adapter failed ({e}).", file=sys.stderr)

{gitvow-0.29.0 → gitvow-0.29.2}/src/gitvow/status.py

@@ -41,6 +41,7 @@ def _agent_checks(home: str, cwd: str) -> list[Check]:
     checks: list[Check] = []
     top = toplevel(cwd)
     found_any = False
+    scopes: dict[str, set[str]] = {}
     for agent, (user_rel, repo_rel) in AGENT_FILES.items():
         for scope, path in (("user", os.path.join(home, user_rel)), ("repo", os.path.join(top or cwd, repo_rel))):
             if scope == "repo" and not top:
@@ -49,6 +50,7 @@ def _agent_checks(home: str, cwd: str) -> list[Check]:
             if not cmds:
                 continue
             found_any = True
+            scopes.setdefault(agent, set()).add(scope)
             where = path.replace(home, "~", 1)
             runnable, resolved, from_path = _executable(cmds[0])
             if not runnable:
@@ -81,6 +83,15 @@ def _agent_checks(home: str, cwd: str) -> list[Check]:
                     )
                 )
             checks += _agent_notes(agent, home, top)
+    for agent, seen in scopes.items():
+        if seen == {"user", "repo"}:
+            checks.append(
+                (
+                    "note",
+                    f"{agent}: hooks installed at user scope and in this repository; the agent merges both, so every event arrives twice",
+                    "handled once since 0.28.5 (deduplicated by tool_use_id); an older gitvow recorded everything twice",
+                )
+            )
     if not found_any:
         checks.append(
             ("fail", "no agent has gitvow hooks installed", "run `gitvow install --user` (add --agent for others)")
@@ -177,6 +188,7 @@ def _git_checks(cwd: str, home: str) -> list[Check]:
     else:
         checks.append(("ok", f"notes.displayRef / rewriteRef → {NOTES_GLOB}", ""))
     checks += _since_install_checks(top, hooks_dir)
+    checks += _hook_environment_checks(top, home)
     gd = git_dir(top)
     if gd and os.path.exists(os.path.join(gd, "gitvow-hooks.log")):
         checks.append(("ok", "this repository has a hook log, so the hooks have run here", ""))
@@ -185,6 +197,55 @@ def _git_checks(cwd: str, home: str) -> list[Check]:
     return checks
 
 
+MINIMAL_PATH = "/usr/bin:/bin:/usr/local/bin:/opt/homebrew/bin"
+
+
+def _hook_environment_checks(top: str, home: str) -> list[Check]:
+    """Can the git hooks actually do their work here?
+
+    Every trailer is written by `python3` from inside a shell hook, with errors discarded so a broken hook never
+    blocks a commit. That is the right failure mode for the commit and the wrong one for the record: without
+    `python3` on the PATH git runs hooks with, commits silently carry nothing. An agent started from Finder or a
+    launch agent has a shorter PATH than a terminal, so both are checked. The pending-commit window is read too,
+    because a window under a minute makes the trailer a race against the harness.
+    """
+    out: list[Check] = []
+    here = shutil.which("python3")
+    minimal = shutil.which("python3", path=MINIMAL_PATH)
+    if not here:
+        out.append(
+            (
+                "fail",
+                "python3 is not on PATH: the git hooks write trailers and notes with it and fail silently without it",
+                "install python3, or put it on the PATH of the shell git runs in",
+            )
+        )
+    elif not minimal:
+        out.append(
+            (
+                "note",
+                f"python3 is on this shell's PATH ({here}) but not on a minimal one ({MINIMAL_PATH})",
+                "an agent started from Finder or by launchd may run git hooks without it; a symlink in /usr/local/bin fixes that",
+            )
+        )
+    else:
+        out.append(("ok", f"python3 reachable from git hooks: {minimal}", ""))
+    try:
+        pol = load_policy(top, home)
+        window = int((pol.get("decisions") or {}).get("commit_window_seconds", 1800))
+        if window < 60:
+            out.append(
+                (
+                    "note",
+                    f"decisions.commit_window_seconds is {window}: a commit queued behind a slow command loses its trailer",
+                    "raise it; the default is 1800",
+                )
+            )
+    except (PolicyError, ValueError, TypeError):
+        pass
+    return out
+
+
 def build(cwd: str, home: str) -> list[Check]:
     checks: list[Check] = []
     try:

{gitvow-0.29.0 → gitvow-0.29.2/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.29.0
+Version: 0.29.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.29.0 → gitvow-0.29.2}/src/gitvow.egg-info/SOURCES.txt

@@ -59,6 +59,7 @@ tests/test_git_rules.py
 tests/test_hardening.py
 tests/test_hooks.py
 tests/test_install_cli.py
+tests/test_native_question.py
 tests/test_pack.py
 tests/test_packaging.py
 tests/test_policy.py
@@ -73,6 +74,7 @@ tests/test_scan.py
 tests/test_serve.py
 tests/test_snapshots.py
 tests/test_status.py
+tests/test_status_environment.py
 tests/test_symlinked_paths.py
 tests/test_sync.py
 tests/test_sync_http.py

gitvow-0.29.2/tests/test_native_question.py

@@ -0,0 +1,65 @@
+"""0.29.2: in Claude Code, a confirm is the agent's own question to the person when the permission mode shows one."""
+
+import io
+import json
+import sys
+
+from gitvow import cli
+from gitvow.adapters import native_question, respond
+from gitvow.decisions import CARD_HEADER, OPEN_CARD_HEADER
+from gitvow.hooks import post_tool_use, session_start
+from tests.conftest import git
+
+CONFIRM = (
+    "CONFIRMATION REQUIRED (pushing to a protected branch). Ask the user before doing this. If they agree, "
+    "record it and run the command again:\n  gitvow decide 1 accept --scope session"
+)
+
+
+def test_prompting_modes_ask_and_other_modes_block():
+    for mode in ("default", "acceptEdits", "plan"):
+        code, out, err = respond("claude", 2, CONFIRM, mode=mode)
+        assert code == 0 and err == ""
+        h = json.loads(out)["hookSpecificOutput"]
+        assert h["permissionDecision"] == "ask" and h["hookEventName"] == "PreToolUse"
+        assert h["permissionDecisionReason"].startswith("gitvow: pushing to a protected branch.")
+    for mode in ("bypassPermissions", "dontAsk", "auto", None, "weird"):
+        assert respond("claude", 2, CONFIRM, mode=mode) == (2, "", CONFIRM)
+
+
+def test_denials_and_the_strict_card_are_never_a_question():
+    assert respond("claude", 2, "BLOCKED by policy (force push).", mode="default")[0] == 2
+    card = CARD_HEADER + "\n1. edit values/production-in/app.yaml"
+    assert respond("claude", 2, card, mode="default")[0] == 2
+    open_card = OPEN_CARD_HEADER + ": 1 finding nobody has answered\n1. edit values/production-in/app.yaml"
+    code, out, _ = respond("claude", 2, open_card, mode="default")
+    assert code == 0 and "Gitvow-Open" in json.loads(out)["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_native_question_wording():
+    q = native_question(CONFIRM)
+    assert "gitvow decide" not in q and "Allow records your approval" in q
+
+
+def test_hook_cli_uses_the_payloads_permission_mode(repo, home, payload, monkeypatch, capsys):
+    monkeypatch.setenv("HOME", str(home))
+    git(repo, "remote", "add", "origin", "git@example.com:acme/ledger.git")
+    session_start(payload("SessionStart"), str(home))
+    p = {**payload("PreToolUse", "Bash", {"command": "git push origin main"}), "permission_mode": "default"}
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(p)))
+    rc = cli.main(["hook", "PreToolUse"])
+    out = capsys.readouterr().out
+    assert rc == 0 and json.loads(out)["hookSpecificOutput"]["permissionDecision"] == "ask"
+    # the person clicked Allow: the command ran, PostToolUse records the approval for the session
+    q = payload("PostToolUse", "Bash", {"command": "git push origin main"})
+    post_tool_use(q, str(home))
+    st = json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    dec = [f["decision"] for f in st["findings"] if f.get("decision")]
+    assert dec and dec[0]["answer"] == "accepted" and dec[0]["scope"] == "session"
+    assert "approved at the agent's prompt" in (dec[0].get("note") or dec[0].get("reason") or "")
+    # the same call under bypass is a block, not a question
+    p["permission_mode"] = "bypassPermissions"
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(p)))
+    rc = cli.main(["hook", "PreToolUse"])
+    assert rc in (0, 2)  # 0 when the session answer now allows it; the point is that no `ask` JSON is emitted
+    assert "permissionDecision" not in capsys.readouterr().out

gitvow-0.29.2/tests/test_status_environment.py

@@ -0,0 +1,61 @@
+"""0.29.1: status checks the environment the git hooks run in."""
+
+import json
+import shutil
+
+from gitvow.install import install_repo, install_user
+from gitvow.status import build
+
+
+def _first(checks, needle):
+    return next((c for c in checks if needle in c[1]), None)
+
+
+def test_python3_missing_from_path_is_a_failure(repo, home, monkeypatch):
+    install_repo(str(repo))
+    monkeypatch.setattr(shutil, "which", lambda name, path=None: None if name == "python3" else "/usr/bin/" + name)
+    checks = build(str(repo), str(home))
+    c = _first(checks, "python3 is not on PATH")
+    assert c and c[0] == "fail" and "fail silently" in c[1]
+
+
+def test_python3_only_on_a_rich_path_is_a_note(repo, home, monkeypatch):
+    install_repo(str(repo))
+    real_which = shutil.which
+
+    def which(name, path=None):
+        if name == "python3":
+            return None if path else "/Users/x/.pyenv/shims/python3"
+        return real_which(name, path=path)
+
+    monkeypatch.setattr(shutil, "which", which)
+    checks = build(str(repo), str(home))
+    c = _first(checks, "not on a minimal one")
+    assert c and c[0] == "note" and "Finder" in c[2]
+
+
+def test_python3_on_a_minimal_path_is_ok(repo, home):
+    install_repo(str(repo))
+    checks = build(str(repo), str(home))
+    c = _first(checks, "python3 reachable from git hooks")
+    assert c and c[0] == "ok"
+
+
+def test_short_commit_window_is_noted(repo, home):
+    install_repo(str(repo))
+    p = repo / ".gitvow" / "policy.json"
+    d = json.loads(p.read_text())
+    d["decisions"]["commit_window_seconds"] = 5
+    p.write_text(json.dumps(d))
+    checks = build(str(repo), str(home))
+    c = _first(checks, "commit_window_seconds is 5")
+    assert c and c[0] == "note"
+
+
+def test_both_scopes_installed_is_noted(repo, home, monkeypatch):
+    monkeypatch.chdir(repo)
+    install_user(str(home))
+    install_repo(str(repo))
+    checks = build(str(repo), str(home))
+    c = _first(checks, "user scope and in this repository")
+    assert c and c[0] == "note" and "0.28.5" in c[2]