judgetap 0.1.1.dev32__tar.gz → 0.1.1.dev34__tar.gz

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: judgetap
-Version: 0.1.1.dev32
+Version: 0.1.1.dev34
 Summary: Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development.
 Project-URL: Homepage, https://github.com/mergesafe-ai/judgetap
 Author-email: Omer Bar-Ness <omer@zsquared.io>
@@ -42,7 +42,7 @@ judgetap guard test "git push --force origin main"
 
 ## What it does
 
-- **Guard.** A hook that checks every shell command (and, in Claude Code, every file write and edit) before it runs. Rules catch common destructive forms: recursive deletes outside the workspace, force-pushes and pushes to protected branches, `DROP`/`DELETE` without `WHERE`, `terraform destroy`, and secrets written to files. With an engine configured, a model judges the rest: is it irreversible? off-task? against a rule in `AGENTS.md`? Without an engine, the rules fail closed for shell commands (anything they can't vouch for asks you); file writes and edits are only checked for secrets and your own rules.
+- **Guard.** A hook that checks every shell command (and, in Claude Code, every file write and edit) before it runs. Rules catch common destructive forms: recursive deletes outside the workspace, force-pushes and pushes to protected branches, `DROP`/`DELETE` without `WHERE`, `terraform destroy`, and secrets written to files. With an engine configured, a model judges the rest: is it irreversible? off-task? against a rule in `AGENTS.md`? Without an engine, the rules fail closed for shell commands (anything they can't vouch for asks you); file writes and edits are checked for secrets, your own rules, and writes to the guard's own configuration (which ask).
 - **Library.** One API (`choice`, `score`, `yesno`, `batch`) over every Jev-style decision engine, with a cascade that escalates low-confidence answers to a stronger engine.
 - **Eval.** `judgetap eval cases.jsonl --engines jev,laya` compares engines on your labelled cases: accuracy, calibration (ECE), latency and cost.
 - **Dashboard.** `judgetap dashboard` is a local page with recent decisions, holds, asks, latency and cost per engine. You can mark a hold as a false alarm.

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/README.md

@@ -25,7 +25,7 @@ judgetap guard test "git push --force origin main"
 
 ## What it does
 
-- **Guard.** A hook that checks every shell command (and, in Claude Code, every file write and edit) before it runs. Rules catch common destructive forms: recursive deletes outside the workspace, force-pushes and pushes to protected branches, `DROP`/`DELETE` without `WHERE`, `terraform destroy`, and secrets written to files. With an engine configured, a model judges the rest: is it irreversible? off-task? against a rule in `AGENTS.md`? Without an engine, the rules fail closed for shell commands (anything they can't vouch for asks you); file writes and edits are only checked for secrets and your own rules.
+- **Guard.** A hook that checks every shell command (and, in Claude Code, every file write and edit) before it runs. Rules catch common destructive forms: recursive deletes outside the workspace, force-pushes and pushes to protected branches, `DROP`/`DELETE` without `WHERE`, `terraform destroy`, and secrets written to files. With an engine configured, a model judges the rest: is it irreversible? off-task? against a rule in `AGENTS.md`? Without an engine, the rules fail closed for shell commands (anything they can't vouch for asks you); file writes and edits are checked for secrets, your own rules, and writes to the guard's own configuration (which ask).
 - **Library.** One API (`choice`, `score`, `yesno`, `batch`) over every Jev-style decision engine, with a cascade that escalates low-confidence answers to a stronger engine.
 - **Eval.** `judgetap eval cases.jsonl --engines jev,laya` compares engines on your labelled cases: accuracy, calibration (ECE), latency and cost.
 - **Dashboard.** `judgetap dashboard` is a local page with recent decisions, holds, asks, latency and cost per engine. You can mark a hold as a false alarm.

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "judgetap"
-version = "0.1.1.dev32"
+version = "0.1.1.dev34"
 description = "Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development."
 readme = "README.md"
 license = "Apache-2.0"

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/src/judgetap/__init__.py

@@ -23,7 +23,7 @@ from judgetap.errors import (
 )
 from judgetap.types import Decision, Question
 
-__version__ = "0.1.1.dev32"  # x-release-please-version
+__version__ = "0.1.1.dev34"  # x-release-please-version
 
 __all__ = [
     "Cascade",

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/src/judgetap/guard/core.py

@@ -99,6 +99,10 @@ def load_user_rules(path: Path, *, trusted: bool = True) -> list[UserRule]:
         return []
     with path.open("rb") as fh:
         data = tomllib.load(fh)
+    return _rules_from(data, path, trusted)
+
+
+def _rules_from(data: dict, path: Path, trusted: bool) -> list[UserRule]:
     rules = []
     for entry in data.get("rule", []):
         outcome = entry.get("outcome", "hold")
@@ -229,6 +233,22 @@ def project_rules(cwd: Path) -> str | None:
     return None
 
 
+def load_rules_counting_allows(
+    path: Path, *, trusted: bool = True
+) -> tuple[list[UserRule], int]:
+    """load_user_rules plus how many `allow` rules were dropped, from one
+    parse of the file (the hook calls this on every action)."""
+    if not path.is_file():
+        return [], 0
+    with path.open("rb") as fh:
+        data = tomllib.load(fh)
+    return _rules_from(data, path, trusted), (
+        0
+        if trusted
+        else sum(1 for e in data.get("rule", []) if e.get("outcome", "hold") == "allow")
+    )
+
+
 def dropped_allows(path: Path) -> int:
     """How many `allow` rules a repo guard.toml has (ignored when loaded untrusted)."""
     if not path.is_file():

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/src/judgetap/guard/hook.py

@@ -24,8 +24,7 @@ from judgetap.guard.core import (
     Action,
     Verdict,
     check,
-    dropped_allows,
-    load_user_rules,
+    load_rules_counting_allows,
     project_rules,
 )
 from judgetap.guard.rules import redact
@@ -56,11 +55,15 @@ def action_from_hook(payload: dict[str, Any]) -> Action | None:
     action = Action(tool=tool, cwd=cwd)
     if tool == "Bash":
         command = inp.get("command")
-        # None means the command couldn't be read: _decide asks rather than allows.
-        action.command = None if command is None else _text(command)
-        action.unreadable = command is None
+        # Only a nonempty string can be inspected; anything else asks.
+        readable = isinstance(command, str) and bool(command.strip())
+        action.command = command if readable else None
+        action.unreadable = not readable
     else:
-        action.path = _text(inp.get("file_path")) or None
+        path = inp.get("file_path")
+        action.path = path if isinstance(path, str) and path.strip() else None
+        # A write whose destination can't be read can't be checked: ask.
+        action.unreadable = action.path is None
         if tool == "Write":
             action.content = _text(inp.get("content"))
         elif tool == "Edit":
@@ -214,17 +217,21 @@ def normalise(payload: dict[str, Any], agent: str) -> dict[str, Any]:
     if agent == "cursor":  # beforeShellExecution: {command, cwd, ...}
         return {
             "tool_name": "Bash",
-            "tool_input": {"command": payload.get("command", "")},
+            # Missing stays None, so the guard asks instead of checking "".
+            "tool_input": {"command": payload.get("command")},
             "cwd": payload.get("cwd"),
             "session_id": payload.get("conversation_id"),
             "transcript_path": payload.get("transcript_path"),
         }
     if agent == "codex" and payload.get("tool_name") in CODEX_SHELL_TOOLS:
         # Codex's shell tool is exec_command with tool_input.cmd (str or argv).
-        inp = payload.get("tool_input") or {}
-        cmd = inp.get("cmd", inp.get("command", ""))
-        if isinstance(cmd, list):
+        inp = payload.get("tool_input")
+        inp = inp if isinstance(inp, dict) else {}
+        cmd = inp.get("cmd", inp.get("command"))
+        if isinstance(cmd, list) and cmd:
             cmd = shlex.join(str(c) for c in cmd)
+        elif not isinstance(cmd, str):
+            cmd = None  # missing or not a command: unreadable, so the guard asks
         return {**payload, "tool_name": "Bash", "tool_input": {"command": cmd}}
     return payload  # Claude Code's PreToolUse shape
 
@@ -261,6 +268,8 @@ def respond(
             reason = _reason(verdict)
             if verdict.outcome == "ask":
                 reason += " Ask the user before running it."
+            if note:
+                reason += f" ({verdict.error})"  # warnings aren't lost on a deny
             return None, 2, reason
         return {}, 0, note
     out = {}
@@ -336,11 +345,12 @@ def _warn_once(session: str | None, key: str) -> bool:
 
 def _decide(action: Action, start: float, session: str | None = None) -> Verdict:
     if getattr(action, "unreadable", False):
-        # A Bash call whose command can't be read: fail closed.
+        # A command or destination that can't be read: fail closed.
+        what = "command" if action.tool == "Bash" else "destination file"
         return Verdict(
             "ask",
             "rules",
-            "the command couldn't be read from the hook input",
+            f"the {what} couldn't be read from the hook input",
             rule="unreadable",
         )
     try:
@@ -355,19 +365,18 @@ def _decide(action: Action, start: float, session: str | None = None) -> Verdict
         (action.cwd / "guard.toml", False),
     ):
         try:
-            rules += load_user_rules(path, trusted=trusted)
-            if (
-                not trusted
-                and (n := dropped_allows(path))
-                and _warn_once(session, f"repo-allow:{path}")
-            ):
+            loaded, n = load_rules_counting_allows(path, trusted=trusted)
+            rules += loaded
+            if n and _warn_once(session, f"repo-allow:{path}"):
                 config_error = f"ignored {n} allow rule(s) in {path}: a repo can only tighten the guard"
         except Exception as err:  # noqa: BLE001 -- a bad config must not disable built-ins
             config_error = f"ignored {path}: {err}"
     verdict = check(action, engine, rules)
-    problem = engine_error or config_error
-    if problem and not verdict.error:
-        verdict.error = problem
+    # Keep every problem: an engine error must not hide a config warning that
+    # _warn_once has already marked as shown for this session.
+    problems = [p for p in (verdict.error, engine_error, config_error) if p]
+    if problems:
+        verdict.error = "; ".join(problems)
         verdict.reason = verdict.reason or "engine unavailable; rules only"
     verdict.latency_ms = verdict.latency_ms or (time.perf_counter() - start) * 1000
     return verdict

{judgetap-0.1.1.dev32 → judgetap-0.1.1.dev34}/src/judgetap/guard/rules.py

@@ -922,6 +922,8 @@ def check_path(
 GUARD_CONFIG_MENTION = re.compile(
     r"(?:guard\.toml|\.claude/settings[^\s'\"/]*\.json|\.cursor/hooks\.json"
     r"|\.codex/hooks\.json|\.codex/config\.toml)"
+    # A whole name: guard.toml.example or settings.json.bak is another file.
+    r"(?![\w.-])"
 )
 
 

judgetap-0.1.1.dev34/tests/test_guard_polish_76.py

@@ -0,0 +1,139 @@
+"""Fixes for the P2s left on #71 (issue #76)."""
+
+import io
+import json
+
+import pytest
+
+from judgetap.guard import hook
+
+
+@pytest.fixture(autouse=True)
+def _home(tmp_path, monkeypatch):
+    monkeypatch.setenv("JUDGETAP_HOME", str(tmp_path / "home"))
+    monkeypatch.delenv("JUDGETAP_ENGINE", raising=False)
+    monkeypatch.delenv("SNAPJUDGE_ENGINE", raising=False)
+
+
+def run(payload, agent="claude-code"):
+    out, err = io.StringIO(), io.StringIO()
+    code = hook.run(io.StringIO(json.dumps(payload)), out, err, agent=agent)
+    return (
+        code,
+        (json.loads(out.getvalue()) if out.getvalue() else None),
+        err.getvalue(),
+    )
+
+
+# P2 1, 2 and 5: missing or malformed commands from Cursor and Codex ask.
+def test_cursor_missing_command_asks(tmp_path):
+    _, out, _ = run({"cwd": str(tmp_path)}, agent="cursor")
+    assert out["permission"] == "ask"
+
+
+@pytest.mark.parametrize(
+    "tool_input",
+    [{}, [], "ls", {"cmd": 5}, {"cmd": []}],
+)
+def test_codex_malformed_tool_input_asks(tmp_path, tool_input):
+    code, _, err = run(
+        {"tool_name": "exec_command", "tool_input": tool_input, "cwd": str(tmp_path)},
+        agent="codex",
+    )
+    assert code == 2 and "couldn't be read" in err
+
+
+# P2 7: a non-string or blank Bash command isn't readable.
+@pytest.mark.parametrize("command", [[], {"a": 1}, 5, "", "   "])
+def test_non_string_command_asks(tmp_path, command):
+    _, out, _ = run(
+        {"tool_name": "Bash", "tool_input": {"command": command}, "cwd": str(tmp_path)}
+    )
+    assert out["hookSpecificOutput"]["permissionDecision"] == "ask"
+
+
+# P2 8: a write without a readable destination asks.
+@pytest.mark.parametrize("tool", ["Write", "Edit", "MultiEdit"])
+def test_write_without_destination_asks(tmp_path, tool):
+    _, out, _ = run(
+        {
+            "tool_name": tool,
+            "tool_input": {"content": "ordinary text"},
+            "cwd": str(tmp_path),
+        }
+    )
+    assert out["hookSpecificOutput"]["permissionDecision"] == "ask"
+    assert "destination" in out["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+# P2 3: example and backup files aren't the active configuration.
+@pytest.mark.parametrize(
+    ("command", "asks"),
+    [
+        ("cat guard.toml.example", False),
+        ("cp .claude/settings.json.backup /tmp/x", False),
+        ("cat guard.toml", True),
+        ("echo x >> .claude/settings.local.json", True),
+    ],
+)
+def test_mention_needs_the_whole_config_name(tmp_path, command, asks):
+    from judgetap.guard.rules import check_command_writes
+
+    assert (check_command_writes(command, tmp_path) is not None) is asks
+
+
+# P2 4: the repo config is parsed once per action.
+def test_repo_config_parsed_once(tmp_path, monkeypatch):
+    import tomllib
+
+    (tmp_path / "guard.toml").write_text('[[rule]]\npattern = "x"\noutcome = "allow"\n')
+    calls = []
+    real = tomllib.load
+    monkeypatch.setattr(tomllib, "load", lambda fh: calls.append(1) or real(fh))
+    run(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": "ls"},
+            "cwd": str(tmp_path),
+            "session_id": "s1",
+        }
+    )
+    assert len(calls) == 1  # ~/.judgetap/guard.toml doesn't exist here
+
+
+# P2 6: the ignored-allow warning survives an engine error and a Codex deny.
+def test_repo_warning_not_lost_behind_engine_error(tmp_path, monkeypatch):
+    monkeypatch.setenv("JUDGETAP_ENGINE", "nonsense")
+    (tmp_path / "guard.toml").write_text('[[rule]]\npattern = "x"\noutcome = "allow"\n')
+    _, out, _ = run(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": "make x"},
+            "cwd": str(tmp_path),
+            "session_id": "s2",
+        }
+    )
+    msg = out["systemMessage"]
+    assert "ignored 1 allow rule" in msg and "nonsense" in msg
+
+
+def test_repo_warning_shown_on_codex_deny(tmp_path):
+    (tmp_path / "guard.toml").write_text('[[rule]]\npattern = "x"\noutcome = "allow"\n')
+    code, _, err = run(
+        {
+            "tool_name": "exec_command",
+            "tool_input": {"cmd": "git push --force"},
+            "cwd": str(tmp_path),
+            "session_id": "s3",
+        },
+        agent="codex",
+    )
+    assert code == 2 and "ignored 1 allow rule" in err
+
+
+# P2 9: README describes the guard-config check.
+def test_readme_mentions_guard_config_check():
+    from pathlib import Path
+
+    readme = (Path(__file__).parent.parent / "README.md").read_text()
+    assert "writes to the guard's own configuration" in readme