@ok-ggwp/git-gloss 0.4.0 → 0.5.0

package/dist/commands/show.js

@@ -5,7 +5,8 @@ import { loadGloss } from '../loader.js';
 import { impactRank } from '../attention.js';
 import { showsImpact, tryAnalyze } from '../floor.js';
 import { IMPACT, NECESSITY, isImpact, isNecessity } from '../schema.js';
-import { current, reviewStatus, statusPhrase, verdict } from '../reviews.js';
+import { current, decisionSummary, readDecisions, readReviews, reviewStatus, statusPhrase, verdict } from '../reviews.js';
+import { plain } from '../plain.js';
 import { attentionBlock, colorDiff, derivedImpactTag, field, groupHeader, hunkLabel, IMPACT_W, impactTag, necessityWord, noteFooter, page, style, termWidth, wrap, } from '../render.js';
 export const usage = 'show [<commit> | <range>] [-g <group>]... [--full] [--diff] [--only <necessity|impact,...> (a group must match each kind named)] [--sort impact]   summarise a gloss, or each commit in a range';
 // Counts over the lines each part selects, not whole hunks, so groups that
@@ -102,12 +103,12 @@ export function run(argv) {
         out.push('', style('dim', '─'.repeat(Math.min(termWidth(), 60))));
         const gloss = glosses[i];
         if (!gloss) {
-            out.push(`${style('yellow', sha.slice(0, 10))} ${style('bold', commitSubject(sha))}`, style('dim', 'no gloss for this commit'));
+            out.push(`${style('yellow', sha.slice(0, 10))} ${style('bold', plain(commitSubject(sha)))}`, style('dim', 'no gloss for this commit'));
             return;
         }
         // An --only filter can leave a commit with nothing to show; say so and move on.
         out.push(...(renderCommit(sha, gloss, values, only, false) ??
-            [`${style('yellow', sha.slice(0, 10))} ${style('bold', gloss.subject)}`, style('dim', `no ${only?.names.join('/')} groups`)]));
+            [`${style('yellow', sha.slice(0, 10))} ${style('bold', plain(gloss.subject))}`, style('dim', `no ${only?.names.join('/')} groups`)]));
     });
     if (glossed)
         out.push('', style('dim', 'One commit in detail: git gloss show <commit> --full   (or -g <group> for its code)'));
@@ -122,7 +123,14 @@ function reviewsLine(sha) {
     if (!statuses.length)
         return style('dim', 'reviews: none recorded');
     const color = (s) => (!current(s) || verdict(s) === 'issues' ? 'yellow' : verdict(s) === 'clean' ? 'green' : 'dim');
-    return `reviews: ${statuses.map((s) => style(color(s), statusPhrase(s))).join(style('dim', ' · '))}` +
+    // What was decided about the reviews that found something (or didn't say);
+    // a commit with only clean reviews has nothing to decide.
+    const open = readReviews(sha).filter((r) => r.verdict !== 'clean');
+    const decisions = readDecisions(sha).filter((d) => open.some((r) => r.id === d.review));
+    const decided = open.length
+        ? ` ${style('dim', '·')} decisions: ${decisionSummary(decisions, open.every((r) => decisions.some((d) => d.review === r.id && d.complete)))}`
+        : '';
+    return `reviews: ${statuses.map((s) => style(color(s), statusPhrase(s))).join(style('dim', ' · '))}${decided}` +
         style('dim', `   (findings: git gloss reviews ${sha.slice(0, 7)})`);
 }
 // One commit's view, or null if no group matches -g/--only. `hints` adds the
@@ -130,14 +138,14 @@ function reviewsLine(sha) {
 function renderCommit(sha, gloss, values, only, hints) {
     const a = gloss.note.annotation;
     const short = sha.slice(0, 7);
-    const out = [`${style('yellow', sha.slice(0, 10))} ${style('bold', gloss.subject)}`];
+    const out = [`${style('yellow', sha.slice(0, 10))} ${style('bold', plain(gloss.subject))}`];
     out.push(...field('task:', a.task, 0));
     if (a.summary)
         out.push(...field('summary:', a.summary, 0));
     for (const w of gloss.warnings)
         out.push(...field('⚠', w, 0).map((l) => style('red', l)));
     const an = tryAnalyze(gloss);
-    out.push(...attentionBlock(a.attention, an ? { floor: an.floor, derived: an.derived } : undefined), reviewsLine(sha));
+    out.push(...attentionBlock(a.attention, an ? { floor: an.floor, derived: an.derived, timedOut: an.timedOut } : undefined), reviewsLine(sha));
     const groups = gloss.groups
         .filter((g) => matchesOnly(g.group, only))
         .filter((g) => !values.group || values.group.includes(g.group.id));

package/dist/commands/signals.js

@@ -1,3 +1,4 @@
+import { plain } from '../plain.js';
 import { parseArgs } from 'node:util';
 import { loadConfig } from '../config.js';
 import { commitDiff, diffBetween, git, GitError, resolveCommit, workingDiff } from '../git.js';
@@ -17,11 +18,11 @@ export function summaryLines(sig, max = 6) {
     const files = sig.files.filter((f) => impactRank(f.floor) >= impactRank('shared'))
         .sort((a, b) => impactRank(b.floor) - impactRank(a.floor) || a.file.localeCompare(b.file));
     for (const f of files.slice(0, max))
-        out.push(`  ${(f.floor + ':').padEnd(10)} ${f.file}${f.why.length ? ` (${f.why.join('; ')})` : ''}`);
+        out.push(`  ${(f.floor + ':').padEnd(10)} ${plain(f.file)}${f.why.length ? ` (${plain(f.why.join('; '))})` : ''}`);
     if (files.length > max)
         out.push(`  ... and ${files.length - max} more at shared or above (git gloss signals)`);
     for (const r of sig.floor.reasons.filter((r) => / files changed /.test(r)))
-        out.push(`  large:     ${r}`);
+        out.push(`  large:     ${plain(r)}`);
     if (sig.floor.reasons.includes(CONFIG_EDIT_NOTE))
         out.push(`  note:      ${CONFIG_EDIT_NOTE}`);
     out.push(`  stats: ${statsLine(sig.stats)}`);
@@ -31,16 +32,16 @@ function detailLines(sig, label) {
     const out = [style('bold', `signals for ${label}:`) + ` floor attention = ${style(['bold', ATTENTION_STYLE[sig.floor.attention]], sig.floor.attention)}` +
             style('dim', `  (floor impact: ${sig.floor.impact})`)];
     for (const r of sig.floor.reasons)
-        out.push(`  why: ${r}`);
+        out.push(`  why: ${plain(r)}`);
     out.push(`  stats: ${statsLine(sig.stats)}`);
     const notable = sig.hunks.filter((h) => impactRank(h.floor) > impactRank('module') || h.hits.length);
     if (notable.length)
         out.push('', style('bold', 'hunks with signals'));
     for (const h of notable) {
-        out.push(`  ${style('bold', h.id.padEnd(5))} ${impactTag(h.floor, 11)} ${h.file}` +
-            style('dim', `  [${h.classes.join(', ') || 'no class'}]${h.why.length ? ' ' + h.why.join('; ') : ''}`));
+        out.push(`  ${style('bold', h.id.padEnd(5))} ${impactTag(h.floor, 11)} ${plain(h.file)}` +
+            style('dim', `  [${h.classes.join(', ') || 'no class'}]${h.why.length ? ' ' + plain(h.why.join('; ')) : ''}`));
         for (const x of h.hits.slice(0, 8)) {
-            out.push(`        ${h.id}:${x.line} ${x.sign} ${x.class} pattern "${x.name}"${x.damped ? style('dim', ' (damped: test, docs or lockfile path)') : ''}  ${style('dim', x.text)}`);
+            out.push(`        ${h.id}:${x.line} ${x.sign} ${x.class} pattern "${x.name}"${x.timedOut ? ' (pattern timed out: counted as matching)' : ''}${x.damped ? style('dim', ' (damped: test, docs or lockfile path)') : ''}  ${style('dim', plain(x.text))}`);
         }
         if (h.hits.length > 8)
             out.push(style('dim', `        ... ${h.hits.length - 8} more hits (--json)`));
@@ -51,9 +52,9 @@ function detailLines(sig, label) {
     if (sig.dependencies.length)
         out.push('', style('bold', 'dependency changes'));
     for (const d of sig.dependencies) {
-        out.push(`  ${d.file} (${d.kind}${d.format ? `, parsed as ${d.format}` : d.kind === 'lockfile' ? ', no version detail for this format' : ''})`);
+        out.push(`  ${plain(d.file)} (${d.kind}${d.format ? `, parsed as ${d.format}` : d.kind === 'lockfile' ? ', no version detail for this format' : ''})`);
         for (const b of d.bumps.slice(0, 20)) {
-            const what = b.kind === 'bump' ? `${b.name} ${b.from} -> ${b.to}` : b.kind === 'added' ? `+ ${b.name} ${b.to}` : `- ${b.name} ${b.from}`;
+            const what = plain(b.kind === 'bump' ? `${b.name} ${b.from} -> ${b.to}` : b.kind === 'added' ? `+ ${b.name} ${b.to}` : `- ${b.name} ${b.from}`);
             out.push(`    ${what}${b.unrelated ? style('yellow', '  (transitive: no manifest change names it)') : ''}`);
         }
         if (d.bumps.length > 20)

package/dist/commands/sync.js

@@ -46,6 +46,18 @@ function shareable(remote, pushing) {
         return new Set();
     return new Set(git(['rev-list', ...starts, '--']).split('\n').filter(Boolean));
 }
+// The fetched ref is the remote's to set: it must be a commit before notes
+// code (or an update-ref onto our own notes ref) touches it.
+function checkTracking(remote, ref, tracking) {
+    if (gitTry(['rev-parse', '-q', '--verify', `${tracking}^{commit}`]) === null) {
+        gitTry(['update-ref', '-d', tracking]);
+        throw new GitError(`${remote}'s ${ref} is not a notes commit; ignoring it (nothing was changed here)`);
+    }
+}
+function fetchTracking(remote, ref, tracking) {
+    git(['fetch', '-q', remote, `+${ref}:${tracking}`]);
+    checkTracking(remote, ref, tracking);
+}
 const PUSH_REF = 'refs/notes/gloss-sync-tmp';
 // One fetch → merge → push round. Returns null if the push lost a race with
 // someone else's push and the round should be retried.
@@ -53,7 +65,7 @@ function round(remote, pushing, carried) {
     const tracking = `refs/notes/remotes/${remote}/gloss`;
     const remoteHas = gitTry(['ls-remote', '--exit-code', remote, NOTES_REF]) !== null;
     if (remoteHas)
-        git(['fetch', '-q', remote, `+${NOTES_REF}:${tracking}`]);
+        fetchTracking(remote, NOTES_REF, tracking);
     const local = noteList(NOTES_REF);
     const theirs = remoteHas ? noteList(tracking) : new Map();
     // The last state both sides shared. A gloss changed on one side only is
@@ -159,7 +171,7 @@ function syncReviews(remote, pushing) {
     const tracking = `refs/notes/remotes/${remote}/gloss-reviews`;
     const remoteHas = gitTry(['ls-remote', '--exit-code', remote, REVIEWS_REF]) !== null;
     if (remoteHas)
-        git(['fetch', '-q', remote, `+${REVIEWS_REF}:${tracking}`]);
+        fetchTracking(remote, REVIEWS_REF, tracking);
     const before = noteList(REVIEWS_REF);
     const theirs = remoteHas ? noteList(tracking) : new Map();
     if (remoteHas) {

package/dist/commands/why.js

@@ -1,3 +1,4 @@
+import { plain } from '../plain.js';
 import { parseArgs } from 'node:util';
 import { blameRange, commitSubject, lineHistory } from '../git.js';
 import { loadGloss } from '../loader.js';
@@ -158,8 +159,8 @@ export function run(argv) {
     const renderStep = (s, label, older) => {
         // Where the lines were in an older commit: after edits or a file rename
         // that differs from the query.
-        const then = older || s.file !== file ? style('dim', `  (${s.file}:${formatRanges(s.lines)} then)`) : '';
-        out.push(`${label}${style('yellow', s.commit.slice(0, 10))} ${s.subject}${then}`);
+        const then = older || s.file !== file ? style('dim', `  (${plain(s.file)}:${formatRanges(s.lines)} then)`) : '';
+        out.push(`${label}${style('yellow', s.commit.slice(0, 10))} ${plain(s.subject)}${then}`);
         if (!s.gloss) {
             out.push(style('dim', '  no gloss for this commit'));
             return;

package/dist/config.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { GlossError, gitTry } from './git.js';
+import { git, GitError, GlossError, gitTry } from './git.js';
 import { globToRegExp } from './glob.js';
 // Settings for the computed signals, in three layers (later wins for scalars,
 // repo config extends the lists of the one before):
@@ -135,6 +135,31 @@ function gitInt(key) {
         throw new ConfigError(`git config gloss.attention.${key} must be a positive integer, got "${v}"`);
     return Number(v);
 }
+// Git failing (a broken repo, an unreadable object, no permission) is not the
+// same as "no base" or "no file": the repo's own, perhaps stricter, config
+// would silently not apply. It is not fatal either (the built-in defaults
+// still give a floor, and refusing to rate anything would make every command
+// fail in a damaged repo), so it is warned about on stderr, once per message,
+// and the defaults are used.
+const warned = new Set();
+function warnOnce(msg) {
+    if (warned.has(msg))
+        return;
+    warned.add(msg);
+    console.error(`warning: ${msg}`);
+}
+// git's output, or null when it exits 1 with nothing to say (its way of
+// answering "no"); any other failure is thrown.
+function gitAnswer(args) {
+    try {
+        return git(args);
+    }
+    catch (err) {
+        if (err instanceof GitError && err.status === 1 && /failed$/.test(err.message))
+            return null;
+        throw err;
+    }
+}
 // The config is read from the base branch, not the working tree: a change under
 // review must not be able to reclassify its own paths or add patterns that
 // lower its own floor. The base is the merge base of the checked-out HEAD (not
@@ -145,18 +170,49 @@ function gitInt(key) {
 // the change's own config. Editing the file in a change is itself flagged: it
 // is always a `sensitive` path.
 function trustedRef() {
+    // No commits yet: no base, and nothing failed.
+    if (gitAnswer(['rev-parse', '--verify', '-q', 'HEAD']) === null)
+        return noBase();
+    let failed = false;
     // Full ref names, so a tag called "main" cannot stand in for the branch.
     for (const b of ['refs/remotes/origin/main', 'refs/heads/main', 'refs/remotes/origin/master', 'refs/heads/master']) {
-        const mb = gitTry(['merge-base', 'HEAD', b])?.trim();
-        if (mb)
-            return mb;
+        try {
+            if (gitAnswer(['rev-parse', '--verify', '-q', b]) === null)
+                continue;
+            const mb = gitAnswer(['merge-base', 'HEAD', b])?.trim();
+            if (mb)
+                return mb;
+        }
+        catch (err) {
+            // A broken candidate does not hide the ones after it.
+            failed = true;
+            warnOnce(`git failed finding the base branch with ${b} (${err.message}); trying the next candidate`);
+        }
     }
+    // Some candidate failed: git's warning above is the reason, not an absent branch.
+    return failed ? (console.error(`warning: no working base branch, so ${CONFIG_FILE} is not read; using the built-in defaults`), null) : noBase();
+}
+function noBase() {
     console.error('warning: no base branch (origin/main, main, origin/master, master) found, so .gloss/config.json is not read; using the built-in defaults');
     return null;
 }
+// The config file at `ref`: null when the file is not there (the usual case),
+// a warning and null when git could not tell or could not read it. Presence
+// is asked of ls-tree (empty output: absent), not read off an error message.
+function configAt(ref) {
+    try {
+        if (!git(['ls-tree', '--full-tree', '--name-only', ref, '--', CONFIG_FILE]).trim())
+            return null;
+        return git(['show', `${ref}:${CONFIG_FILE}`]);
+    }
+    catch (err) {
+        warnOnce(`${CONFIG_FILE} could not be read from the base branch (${err.message}); using the built-in defaults, so the repo's own patterns do not apply`);
+        return null;
+    }
+}
 function readRepoConfig() {
     const ref = trustedRef();
-    const text = ref ? gitTry(['show', `${ref}:${CONFIG_FILE}`]) : null;
+    const text = ref ? configAt(ref) : null;
     if (text === null)
         return undefined;
     let json;

package/dist/floor.js

@@ -1,7 +1,7 @@
 import { ConfigError, loadConfig } from './config.js';
 import { attentionForImpact, attentionRank, impactRank, maxAttention, maxImpact, raise } from './attention.js';
 import { servesOf } from './schema.js';
-import { analyze, CONFIG_EDIT_NOTE, partFloor } from './signals.js';
+import { analyze, CONFIG_EDIT_NOTE, partFloor, timedOutNotes } from './signals.js';
 import { changedCount, selections } from './selection.js';
 // The groups of a loaded gloss with their current hunks (a hunk that is gone is skipped).
 export function groupInputs(gloss) {
@@ -101,7 +101,7 @@ export function analyzeGroups(hunks, groups, cfg) {
         level = maxAttention(level, signals.floor.attention);
         reasons.push(`floor ${signals.floor.attention}: ${signals.floor.reasons[0] ?? signals.floor.impact}`);
     }
-    return { signals, groups: floors, floor: signals.floor.attention, derived: { level, reasons } };
+    return { signals, groups: floors, floor: signals.floor.attention, derived: { level, reasons }, timedOut: timedOutNotes(signals.hunks) };
 }
 export const analyzeGloss = (gloss, cfg) => analyzeGroups(gloss.hunks, groupInputs(gloss), cfg);
 export function ratingProblems(a, an) {

package/dist/git.js

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Annotation, NOTE_FORMAT } from './schema.js';
 import { parsePath, unquote } from './diff.js';
+import { plain } from './plain.js';
 export const NOTES_REF = 'refs/notes/gloss';
 // Glosses of uncommitted work (wip snapshots) live in their own notes ref,
 // which sync never pushes, and the latest snapshot in a private ref that
@@ -18,6 +19,8 @@ export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 export class GlossError extends Error {
 }
 export class GitError extends GlossError {
+    // git's exit code, when it ran and failed (1 is often "no", 128 a real failure).
+    status;
 }
 export function git(args, input, env = {}) {
     try {
@@ -32,7 +35,9 @@ export function git(args, input, env = {}) {
     }
     catch (err) {
         const stderr = err.stderr?.trim();
-        throw new GitError(stderr || `git ${args.join(' ')} failed`);
+        const e = new GitError(stderr || `git ${args.join(' ')} failed`);
+        e.status = typeof err.status === 'number' ? err.status : undefined;
+        throw e;
     }
 }
 export function gitTry(args, input) {
@@ -224,6 +229,15 @@ function rawNote(ref, sha) {
         throw err;
     }
 }
+function cleanStrings(v) {
+    if (typeof v === 'string')
+        return plain(v, true);
+    if (Array.isArray(v))
+        return v.map(cleanStrings);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, cleanStrings(x)]));
+    return v;
+}
 export function readNote(sha) {
     // A commit's gloss, or a wip snapshot's (they are never the same object).
     const raw = rawNote(NOTES_REF, sha) ?? rawNote(WIP_NOTES_REF, sha);
@@ -249,7 +263,9 @@ export function readNote(sha) {
     if (![1, 2, 3, 4].includes(data?.gloss) || !Array.isArray(data.hunks) || !annotation.success) {
         throw new GlossError(`${at} is malformed; replace it with \`git gloss add --force\``);
     }
-    return { ...data, annotation: annotation.data };
+    // The gloss's text is shown in a terminal, and a note can come from anyone
+    // who can push to the remote: no escape sequences or control characters get through.
+    return { ...data, annotation: cleanStrings(annotation.data) };
 }
 export function writeNote(sha, note, ref = NOTES_REF) {
     git(['notes', '--ref', ref, 'add', '-f', '-F', '-', sha], JSON.stringify(note, null, 2) + '\n');

package/dist/html/client.js

@@ -62,7 +62,7 @@
     return { level: null, source: 'unrated' }
   }
   function fileCount(c) {
-    var seen = {}
+    var seen = Object.create(null)
     c.groups.forEach(function (g) { g.hunks.forEach(function (h) { seen[h.file] = true }) })
     c.unannotated.forEach(function (h) { seen[h.file] = true })
     return Object.keys(seen).length
@@ -72,7 +72,7 @@
   var readCache = {}
   function readSet(c) {
     if (!readCache[c.sha]) {
-      var s = {}
+      var s = Object.create(null) // no prototype: a group id like "constructor" must not read as already read
       try {
         var raw = window.sessionStorage.getItem('git-gloss:read:' + c.sha)
         if (raw) JSON.parse(raw).forEach(function (id) { s[id] = true })
@@ -240,6 +240,11 @@
       reasons.forEach(function (r) { ul.appendChild(el('li', null, r)) })
       add(box, ul)
     }
+    if (k && k.timedOut && k.timedOut.length) {
+      var tl = el('ul', 'timedout')
+      k.timedOut.forEach(function (r) { tl.appendChild(el('li', null, r)) })
+      add(box, tl)
+    }
     if (c.risks.length) {
       var rb = button('linkbtn', plural(c.risks.length, 'risk') + ' flagged', function () { selectRisks(commits.indexOf(c)) })
       add(box, add(el('p', 'look'), rb))
@@ -278,6 +283,8 @@
 
   // ---- markdown: a small subset, built as DOM nodes (never parsed as HTML) ----
   var ALNUM = /[A-Za-z0-9]/
+  // Review text is untrusted and unbounded: no emphasis or link may reach further than this.
+  var MAX_SPAN = 500
   function inline(parent, s) {
     var i = 0, buf = ''
     function flush() { if (buf) { parent.appendChild(text(buf)); buf = '' } }
@@ -290,12 +297,13 @@
         j = s.indexOf('**', i + 2)
         if (j > i + 2) { flush(); parent.appendChild(inline(el('strong'), s.slice(i + 2, j))); i = j + 2; continue }
       } else if (ch === '*' && s.charAt(i + 1) && !/[\s*]/.test(s.charAt(i + 1)) && (i === 0 || !ALNUM.test(s.charAt(i - 1)))) {
-        for (j = i + 2; j < s.length; j++) {
+        // Looks no further than MAX_SPAN: an unclosed marker would otherwise re-read the rest of the text each time (quadratic).
+        for (j = i + 2; j < s.length && j < i + MAX_SPAN; j++) {
           if (s.charAt(j) === '*' && !/\s/.test(s.charAt(j - 1)) && !ALNUM.test(s.charAt(j + 1)) && s.charAt(j + 1) !== '*') break
         }
-        if (j < s.length) { flush(); parent.appendChild(inline(el('em'), s.slice(i + 1, j))); i = j + 1; continue }
+        if (j < s.length && j < i + MAX_SPAN) { flush(); parent.appendChild(inline(el('em'), s.slice(i + 1, j))); i = j + 1; continue }
       } else if (ch === '[') {
-        m = /^\[([^\]]+)\]\(([^)\s]+)\)/.exec(s.slice(i))
+        m = /^\[([^\]]{1,200})\]\(([^)\s]{1,400})\)/.exec(s.slice(i, i + MAX_SPAN))
         if (m) { flush(); inline(parent, m[1]); parent.appendChild(el('span', 'muted', ' (' + m[2] + ')')); i += m[0].length; continue }
       }
       buf += ch
@@ -466,6 +474,10 @@
 
   // ---- the detail pane ----
   var topEl = el('header', 'top')
+  // Served by `git gloss ary`: the branch pickers (src/ary/picker.js, included
+  // ahead of this script only then) live in the top bar. Built once, since
+  // the bar is rebuilt on every change of filter.
+  var aryEl = data.ary ? aryBar(data.ary, el, add) : null
   var railEl = el('aside', 'rail')
   railEl.setAttribute('aria-label', multi ? 'Commits in the range' : 'Groups in review order')
   var mainEl = el('main', 'main')
@@ -562,7 +574,7 @@
     var order = c.order
     var hunkN = g.hunks.length
     var files = []
-    var perFile = {}
+    var perFile = Object.create(null)
     g.hunks.forEach(function (h) {
       if (!perFile[h.file]) { perFile[h.file] = 0; files.push(h.file) }
       perFile[h.file]++
@@ -753,7 +765,7 @@
   function renderTop() {
     var c = commits[state.ci]
     topEl.textContent = ''
-    add(topEl, el('span', 'brand', 'git gloss'))
+    add(topEl, el('span', 'brand', 'git gloss'), aryEl)
     if (multi) {
       var glossed = commits.filter(function (x) { return x.glossed }).length
       var vetted = commits.filter(function (x) {
@@ -1091,8 +1103,12 @@
 
   // ---- start ----
   var desk = add(el('div', 'desk'), topEl, body)
+  // The rail sticks below the top bar, whose height varies (the pickers wrap).
+  function measureTop() { desk.style.setProperty('--top-h', topEl.offsetHeight + 'px') }
   app.textContent = ''
   app.appendChild(desk)
+  measureTop()
+  if (typeof ResizeObserver !== 'undefined') new ResizeObserver(measureTop).observe(topEl)
   if (multi) {
     var first = commitOrder()[0]
     state.ci = first

package/dist/html/data.js

@@ -127,7 +127,7 @@ export function commitData(gloss) {
         task: a.task,
         summary: a.summary,
         attention: a.attention ?? null,
-        computed: an ? { floor: an.floor, derived: an.derived, below: belowFloor(a.attention, an) } : null,
+        computed: an ? { floor: an.floor, derived: an.derived, below: belowFloor(a.attention, an), timedOut: an.timedOut } : null,
         warnings: gloss.warnings,
         groups,
         order: reviewOrder(groups, a.attention?.focus),

package/dist/html/page.js

@@ -27,7 +27,7 @@ ${asset('./style.css')}
 <div id="app"><noscript>This page needs JavaScript to render the gloss.</noscript></div>
 <script type="application/json" id="gloss-data">${embedJson(data)}</script>
 <script nonce="${nonce}">
-${asset('./client.js')}
+${data.ary ? asset('../ary/picker.js') + '\n' : ''}${asset('./client.js')}
 </script>
 </body>
 </html>

package/dist/html/style.css

@@ -119,13 +119,38 @@ kbd { font-family: var(--mono); font-size: 11px; border: 1px solid var(--line);
 .track { width: 120px; height: 6px; border-radius: 3px; background: var(--line); overflow: hidden; }
 .track i { display: block; height: 100%; width: 0; background: var(--accent); }
 
+/* Branch pickers and revision box in the top bar, only when served by `git gloss ary` */
+.ary-bar { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 14px; min-width: 0; }
+.ary-repo { color: var(--muted); font-family: var(--mono); font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 200px; }
+.ary-field { display: flex; align-items: center; gap: 6px; color: var(--muted); font-size: 12px; }
+.ary-notice { flex-basis: 100%; margin: 0; padding: 6px 10px; border-radius: 8px; border: 1px dashed var(--warn); font-size: 13px; color: var(--ink); }
+.combo { position: relative; }
+.combo-btn, .combo-panel input, .ary-rev input { border: 1px solid var(--line); background: var(--panel); color: var(--ink); border-radius: 8px; min-height: 36px; padding: 4px 12px; font-size: 13px; }
+.combo-btn { position: relative; max-width: 220px; padding-right: 28px; text-align: left; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: var(--mono); font-size: 12.5px; }
+.combo-btn::after { content: "▾"; position: absolute; right: 10px; color: var(--muted); }
+.combo-btn:hover { background: var(--accent-soft); }
+.combo-panel { position: absolute; z-index: 10; left: 0; top: calc(100% + 4px); width: 300px; max-width: calc(100vw - 32px); display: grid; gap: 6px; padding: 6px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); box-shadow: 0 8px 24px rgb(0 0 0 / 0.25); }
+.combo-panel[hidden] { display: none; }
+.combo-panel input { width: 100%; }
+.combo-list { max-height: min(50vh, 320px); overflow: auto; }
+.combo-group { margin-top: 8px; padding: 10px 8px 4px; border-top: 1px solid var(--line); font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink); }
+.combo-group:first-child { margin-top: 0; padding-top: 4px; border-top: 0; }
+.combo-group .count { margin-left: 6px; color: var(--muted); font-weight: 400; }
+.combo-item { display: block; width: 100%; text-align: left; border: 0; background: none; border-radius: 6px; padding: 5px 8px 5px 20px; font-family: var(--mono); font-size: 12.5px; color: var(--ink); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.combo-item:hover, .combo-item.active { background: var(--accent-soft); }
+.combo-item[aria-selected="true"] { color: var(--accent); font-weight: 600; }
+.combo-more { padding: 6px 8px; color: var(--muted); font-size: 12.5px; }
+.ary-rev input { width: 220px; max-width: 100%; font-family: var(--mono); font-size: 12.5px; }
+
 /* Body: rail above the pane when narrow, beside it from 900px */
 .body { flex: 1; display: grid; grid-template-columns: minmax(0, 1fr); align-items: start; }
 @media (min-width: 900px) {
   /* the rail's panel colour runs the full height, however tall the top bar is */
   .body { grid-template-columns: 360px minmax(0, 1fr); background: linear-gradient(90deg, var(--panel) 359px, var(--line) 359px 360px, transparent 360px); }
   .body.range { grid-template-columns: 400px minmax(0, 1fr); background: linear-gradient(90deg, var(--panel) 399px, var(--line) 399px 400px, transparent 400px); }
-  .rail { position: sticky; top: 0; max-height: 100vh; overflow: auto; overscroll-behavior: contain; border-bottom: 0; border-right: 1px solid var(--line); }
+  /* the bar stays put and the rail fits in what is left (--top-h is measured by the script) */
+  .top { position: sticky; top: 0; z-index: 5; }
+  .rail { position: sticky; top: var(--top-h, 0px); max-height: calc(100vh - var(--top-h, 0px)); overflow: auto; overscroll-behavior: contain; border-bottom: 0; border-right: 1px solid var(--line); }
 }
 .rail { background: var(--panel); border-bottom: 1px solid var(--line); display: flex; flex-direction: column; min-width: 0; }
 .main { min-width: 0; padding: 20px 16px 48px; }
@@ -139,6 +164,7 @@ kbd { font-family: var(--mono); font-size: 11px; border: 1px solid var(--line);
 .att li { margin-bottom: 4px; }
 .att .look { margin: 10px 0 0; font-size: 13px; }
 .att .override { margin: 10px 0 0; font-size: 13px; color: var(--warn-text); background: var(--warn-bg); border-radius: 6px; padding: 6px 10px; }
+.att .timedout { margin: 10px 0 0; padding: 6px 10px 6px 28px; font-size: 13px; color: var(--warn-text); background: var(--warn-bg); border-radius: 6px; }
 .att .override.mismatch { font-weight: 600; border: 1px solid var(--warn-border); }
 .gauge { display: inline-flex; gap: 3px; }
 .gauge i { display: block; width: 22px; height: 8px; border-radius: 2px; background: var(--line); }

package/dist/loader.js

@@ -1,6 +1,6 @@
-import { commitDiff, commitSubject, readNote } from './git.js';
+import { commitDiff, commitSubject, GlossError, readNote } from './git.js';
 import { parseDiff } from './diff.js';
-import { changedCount, selections, uncovered } from './selection.js';
+import { changedCount, claimsProblem, selections, uncovered } from './selection.js';
 const locationKey = (h) => [h.file, h.oldFile ?? '', h.oldStart, h.oldLines, h.newStart, h.newLines].join('\0');
 // Pair each stored hunk with a current one: first by the hash of its changes
 // (it may have moved in a rebase), then by location (same place, different
@@ -49,6 +49,10 @@ export function loadGloss(sha) {
         })),
     }));
     const claims = groups.flatMap((g) => g.hunks.flatMap((h) => (h.current ? [{ hunk: h.current, lines: h.lines }] : [])));
+    // Readers refuse what `add` refuses (see claimsProblem).
+    const tooMany = claimsProblem(claims, current);
+    if (tooMany)
+        throw new GlossError(`the gloss on ${sha.slice(0, 10)} is refused: ${tooMany}`);
     const unannotated = uncovered(current, claims);
     const bad = [...resolved.values()].filter((h) => h.status !== 'ok').length;
     const matched = new Set([...resolved.values()].map((h) => h.current));

package/dist/plain.js

@@ -0,0 +1,9 @@
+// Text from a note is shown in a terminal: no escape sequences or other
+// control characters get through. Newlines and tabs stay when `multiline`.
+export function plain(text, multiline = false) {
+    return text
+        // OSC (ended by BEL or ESC \) and CSI sequences, then any lone ESC and control characters (newline and tab kept when multiline).
+        .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, '')
+        .replace(/\x1b\[[0-?]*[ -/]*[@-~]?/g, '')
+        .replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, (c) => (multiline && (c === '\n' || c === '\t') ? c : ' '));
+}

package/dist/render.js

@@ -1,3 +1,4 @@
+import { plain } from './plain.js';
 import { spawnSync } from 'node:child_process';
 import { styleText } from 'node:util';
 import { gitTry } from './git.js';
@@ -54,21 +55,22 @@ export function attentionBlock(a, view) {
             return [style('dim', 'attention: unrated')];
         const d = view.derived;
         return [`attention: ${level(d.level)} ${style('dim', '(derived)')}` + (d.level === view.floor ? '' : ` · floor: ${view.floor}`),
-            ...d.reasons.flatMap((r) => field('•', r))];
+            ...d.reasons.flatMap((r) => field('•', r)), ...timedOutLines(view)];
     }
     const head = `attention: ${level(a.level)}${view ? ' ' + style('dim', '(declared)') + ` · floor: ${view.floor}` : ''}` +
         (a.focus?.length ? ` · focus: ${a.focus.join(', ')}` : '');
     const below = belowFloor(a, view);
     return [head, ...(a.reasons ?? []).flatMap((r) => field('•', r)),
         ...(below ? field('⚠', `declared ${a.level}, below the computed floor ${view.floor}` + (a.override_reason ? '' : ' (no override_reason)'), 2).map((l) => style('yellow', l)) : []),
-        ...(a.override_reason ? field('override:', a.override_reason) : [])];
+        ...(a.override_reason ? field('override:', a.override_reason) : []), ...timedOutLines(view)];
 }
+const timedOutLines = (view) => (view?.timedOut ?? []).flatMap((r) => field('⚠', r, 2).map((l) => style('yellow', l)));
 export const termWidth = () => Math.min(process.stdout.columns || 100, 120);
 // Word-wrap plain text to `width` columns.
 export function wrap(text, width) {
     const lines = [];
     let line = '';
-    for (const word of text.split(/\s+/).filter(Boolean)) {
+    for (const word of plain(text).split(/\s+/).filter(Boolean)) {
         if (line && line.length + 1 + word.length > width) {
             lines.push(line);
             line = word;
@@ -90,7 +92,7 @@ export function hunkLabel(h, lines = null) {
     const range = h.newLines || h.oldLines
         ? `-${h.oldStart},${h.oldLines} +${h.newStart},${h.newLines}`
         : 'file header';
-    const file = h.oldFile && h.oldFile !== h.file ? `${h.oldFile} → ${h.file}` : h.file;
+    const file = plain(h.oldFile && h.oldFile !== h.file ? `${h.oldFile} → ${h.file}` : h.file);
     const s = sliceStats(h, lines);
     return `${style('bold', refLabel(h.id, lines))}  ${file}  ${style('dim', range)}  ${style('green', `+${s.added}`)} ${style('red', `-${s.removed}`)}`;
 }