gitvow 0.34.0__tar.gz → 0.34.2__tar.gz

{gitvow-0.34.0/src/gitvow.egg-info → gitvow-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.34.0
+Version: 0.34.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.34.0 → gitvow-0.34.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitvow"
-version = "0.34.0"
+version = "0.34.2"
 description = "Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{gitvow-0.34.0 → gitvow-0.34.2}/src/gitvow/hooks/__init__.py

@@ -275,6 +275,13 @@ def pre_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:
             "observed" if d.observed else "finding",
             {"tool": tool, "reason": d.reason[:200], "new": new, "session_id": h.get("session_id")},
         )
+    if tool == "Bash" and PUSH_RE.search(inp.get("command", "")) and not os.environ.get("GITVOW_PUSHING_NOTES"):
+        # The agent is about to push. The pre-push hook steps aside while this is fresh, and PostToolUse pushes
+        # the notes after the branch has landed, so the two pushes never overlap on the server.
+        st = load_state(cwd)
+        st["pending_push"] = time.time()
+        st["pending_ttl"] = int((pol.get("decisions") or {}).get("commit_window_seconds", 1800))
+        save_state(cwd, st)
     if tool == "Bash" and COMMIT_RE.search(inp.get("command", "")):
         pending = dec.undecided(cwd)
         mode = (pol.get("decisions") or {}).get("mode", "open")
@@ -462,6 +469,21 @@ def post_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]
     cwd = target_cwd(tool, inp, session_cwd)
     if _duplicate(h, cwd, "post"):
         return 0, ""
+    code, msg = _post_tool_use(h, home, tool, inp, cwd)
+    if tool == "Bash" and PUSH_RE.search(inp.get("command", "")) and not os.environ.get("GITVOW_PUSHING_NOTES"):
+        # The notes travel after the branch, never alongside it: the pre-push hook stepped aside for this push
+        # (or never ran, as under Gemini). Done last, after any note for a `commit && push` chain was attached,
+        # so the note travels with the push it belongs to.
+        st = load_state(cwd)
+        if "pending_push" in st:
+            st.pop("pending_push", None)
+            save_state(cwd, st)
+        _push_notes_after(cwd, inp.get("command", ""))
+    return code, msg
+
+
+def _post_tool_use(h: dict[str, Any], home: str | None, tool: str, inp: dict[str, Any], cwd: str) -> tuple[int, str]:
+    session_cwd = h.get("cwd") or os.getcwd()
     if tool in EDIT_TOOLS:
         fp = str(inp.get("file_path") or inp.get("notebook_path") or "")
         if fp:
@@ -482,9 +504,6 @@ def post_tool_use(h: dict[str, Any], home: str | None = None) -> tuple[int, str]
         return 0, ""
     if tool == "Bash" and not COMMIT_RE.search(inp.get("command", "")):
         _record_prompt_approval(cwd, inp, home)
-        if hooks_disabled_by_env() and PUSH_RE.search(inp.get("command", "")):
-            # the pre-push hook that carries the notes never ran; carry them now, after the push it belongs to
-            _push_notes_after(cwd, inp.get("command", ""))
         return 0, ""
     if tool != "Bash":
         return 0, ""
@@ -662,7 +681,9 @@ def _push_notes_after(cwd: str, command: str) -> None:
         capture_output=True,
         text=True,
     )
-    log_event(cwd, "notes_pushed_by_hook", {"remote": remote, "ok": r.returncode == 0, "error": (r.stderr or "")[:120]})
+    log_event(
+        cwd, "notes_pushed_after_push", {"remote": remote, "ok": r.returncode == 0, "error": (r.stderr or "")[:120]}
+    )
 
 
 def stop(h: dict[str, Any], home: str | None = None) -> tuple[int, str]:

{gitvow-0.34.0 → gitvow-0.34.2}/src/gitvow/install.py

@@ -72,11 +72,20 @@ PRE_PUSH_HOOK = """#!/bin/sh
 # gitvow: push session notes (refs/notes/gitvow/*) to the same remote whenever a branch is pushed.
 # The inner push re-enters this hook; GITVOW_PUSHING_NOTES stops the recursion.
 REMOTE="$1"
-if [ -z "$GITVOW_PUSHING_NOTES" ] && [ -n "$REMOTE" ] && git for-each-ref --count=1 refs/notes/gitvow/ | grep -q .; then
+GD0="$(git rev-parse --git-dir)"; STATE0="$GD0/gitvow-session.json"
+# An agent's push: the gate saw the command and PostToolUse pushes the notes *after* the branch lands, so this
+# hook stays out of the way. Two pushes overlapping on the server made GitHub reject the branch with
+# "fatal error in commit_refs" (seen four times in a day of releases); one after the other never does.
+AGENT_PUSH=""
+if [ -f "$STATE0" ]; then
+  AGENT_PUSH=$(python3 -c "import json,time;s=json.load(open('$STATE0'));p=s.get('pending_push') or 0;w=s.get('pending_ttl') or 300;print('1' if time.time()-p<w else '')" 2>/dev/null)
+fi
+if [ -z "$GITVOW_PUSHING_NOTES" ] && [ -z "$AGENT_PUSH" ] && [ -n "$REMOTE" ] && git for-each-ref --count=1 refs/notes/gitvow/ | grep -q .; then
   # Errors used to be discarded, so a notes push that failed left a record nobody could see was missing.
   # The failure is now said once, on the hook's stderr, and never stops the branch push.
-  GD0="$(git rev-parse --git-dir)"
-  if ! GITVOW_PUSHING_NOTES=1 git push --quiet "$REMOTE" 'refs/notes/gitvow/*:refs/notes/gitvow/*' 2>"$GD0/gitvow-notes-push.err" </dev/null; then
+  if GITVOW_PUSHING_NOTES=1 git push --quiet "$REMOTE" 'refs/notes/gitvow/*:refs/notes/gitvow/*' 2>"$GD0/gitvow-notes-push.err" </dev/null; then
+    sleep 1  # let the server finish committing the notes refs before the branch push reaches it
+  else
     echo "gitvow: pushing refs/notes/gitvow/* to $REMOTE failed ($(head -c 200 "$GD0/gitvow-notes-push.err" | tr '\\n' ' ')); run: gitvow push-notes $REMOTE" >&2
   fi
 fi

{gitvow-0.34.0 → gitvow-0.34.2/src/gitvow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitvow
-Version: 0.34.0
+Version: 0.34.2
 Summary: Provenance and policy gate for AI-agent coding sessions: session trailers on commits, redacted session notes in git, a tool-call gate, and a local ledger. No runtime dependencies.
 Author-email: Nikhil Bora <nikhil@wirevow.com>
 License: Apache-2.0

{gitvow-0.34.0 → gitvow-0.34.2}/tests/test_hooks_disabled.py

@@ -113,14 +113,15 @@ def test_notes_are_pushed_after_the_agents_push_when_hooks_are_off(repo, home, p
         check=True,
     )
     assert git(bare, "for-each-ref", "refs/notes/") == ""
-    # hooks on: gitvow trusts the pre-push hook and does nothing here
+    # after any agent push the notes follow, sequentially (0.34.1): hooks on or off makes no difference here
     post_tool_use(payload("PostToolUse", "Bash", {"command": "git push origin main"}), str(home))
-    assert git(bare, "for-each-ref", "refs/notes/") == ""
+    assert git(bare, "rev-parse", "refs/notes/gitvow/s1") == git(repo, "rev-parse", "refs/notes/gitvow/s1")
+    assert '"kind": "notes_pushed_after_push"' in (repo / ".git" / "gitvow-hooks.log").read_text()
     for k, v in GEMINI_ENV.items():
         monkeypatch.setenv(k, v)
+    git(repo, "notes", "--ref=gitvow/s1", "add", "-f", "-m", 'gitvow-session\n{"x": 1}', "HEAD")
     post_tool_use(payload("PostToolUse", "Bash", {"command": "git push origin main"}), str(home))
     assert git(bare, "rev-parse", "refs/notes/gitvow/s1") == git(repo, "rev-parse", "refs/notes/gitvow/s1")
-    assert '"kind": "notes_pushed_by_hook"' in (repo / ".git" / "gitvow-hooks.log").read_text()
 
 
 def test_identity_falls_back_to_the_gitconfig_file_gemini_hides(repo, home, monkeypatch):
@@ -132,3 +133,47 @@ def test_identity_falls_back_to_the_gitconfig_file_gemini_hides(repo, home, monk
     monkeypatch.delenv("GIT_CONFIG_GLOBAL")
     monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(home / ".gitconfig"))
     assert dec.identity(str(repo))[0] == "priya"  # the ordinary path still reads it
+
+
+def test_the_pre_push_hook_steps_aside_for_an_agents_push(repo, home, payload, tmp_path):
+    """The gate marks the agent's push; the hook then leaves the notes to PostToolUse, so the two never overlap."""
+    bare = tmp_path / "remote.git"
+    subprocess.run(["git", "init", "-q", "--bare", str(bare)], check=True)
+    git(repo, "remote", "add", "origin", str(bare))
+    _write_git_hook(str(repo / ".gitvow" / "git-hooks"))
+    git(repo, "config", "core.hooksPath", ".gitvow/git-hooks")
+    git(repo, "notes", "--ref=gitvow/s1", "add", "-m", "gitvow-session\n{}", "HEAD")
+    session_start(payload("SessionStart"), str(home))
+    code, _ = pre_tool_use(payload("PreToolUse", "Bash", {"command": "git push origin feature"}), str(home))
+    assert code == 0
+    st = json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    assert st["pending_push"] and st["pending_ttl"] == 1800
+    subprocess.run(["git", "push", "-q", "origin", "HEAD:refs/heads/feature"], cwd=repo, check=True)
+    assert git(bare, "for-each-ref", "refs/notes/") == ""  # the hook stepped aside
+    post_tool_use(payload("PostToolUse", "Bash", {"command": "git push origin feature"}), str(home))
+    assert git(bare, "rev-parse", "refs/notes/gitvow/s1") == git(repo, "rev-parse", "refs/notes/gitvow/s1")
+    assert "pending_push" not in json.loads((repo / ".git" / "gitvow-session.json").read_text())
+    # a person's push, no gate involved: the hook carries the notes itself
+    git(repo, "notes", "--ref=gitvow/s1", "add", "-f", "-m", 'gitvow-session\n{"y": 2}', "HEAD")
+    subprocess.run(["git", "push", "-q", "origin", "HEAD:refs/heads/feature2"], cwd=repo, check=True)
+    assert git(bare, "rev-parse", "refs/notes/gitvow/s1") == git(repo, "rev-parse", "refs/notes/gitvow/s1")
+
+
+def test_a_commit_and_push_chain_sends_the_note_with_the_push(repo, home, payload, transcript, tmp_path):
+    """`git commit … && git push` takes the commit path; the notes must still follow, after the note is attached."""
+    bare = tmp_path / "remote.git"
+    subprocess.run(["git", "init", "-q", "--bare", str(bare)], check=True)
+    git(repo, "remote", "add", "origin", str(bare))
+    _write_git_hook(str(repo / ".gitvow" / "git-hooks"))
+    git(repo, "config", "core.hooksPath", ".gitvow/git-hooks")
+    session_start(payload("SessionStart"), str(home))
+    cmd = "git commit -am x && git push origin HEAD:refs/heads/feature"  # not protected: no question
+    assert pre_tool_use(payload("PreToolUse", "Bash", {"command": cmd}, transcript), str(home))[0] == 0
+    (repo / "a.txt").write_text("chain\n")
+    git(repo, "commit", "-qam", "chain")
+    subprocess.run(["git", "push", "-q", "origin", "HEAD:refs/heads/feature"], cwd=repo, check=True)
+    assert git(bare, "for-each-ref", "refs/notes/") == ""  # the hook stepped aside for the agent's push
+    code, msg = post_tool_use(payload("PostToolUse", "Bash", {"command": cmd}, transcript), str(home))
+    assert code == 0 and "session note attached" in msg
+    local = git(repo, "rev-parse", "refs/notes/gitvow/sess-1")
+    assert git(bare, "rev-parse", "refs/notes/gitvow/sess-1") == local  # the note just written is on the remote