@ok-ggwp/git-gloss 0.5.0 → 0.7.0

package/dist/git.js

@@ -1,8 +1,8 @@
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdtempSync, rmSync, statSync, utimesSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync, utimesSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { Annotation, NOTE_FORMAT } from './schema.js';
+import { Annotation, MAX_NOTE_BYTES, NOTE_FORMAT } from './schema.js';
 import { parsePath, unquote } from './diff.js';
 import { plain } from './plain.js';
 export const NOTES_REF = 'refs/notes/gloss';
@@ -21,10 +21,33 @@ export class GlossError extends Error {
 export class GitError extends GlossError {
     // git's exit code, when it ran and failed (1 is often "no", 128 a real failure).
     status;
+    // The call was killed at GIT_GLOSS_GIT_TIMEOUT: unlike a failure, not an answer.
+    timedOut = false;
 }
-export function git(args, input, env = {}) {
+// How long one git call may run before it is killed (ms; 0 = no limit). A
+// hung git (a stuck filesystem, a credential helper, a lock) would otherwise
+// hang git-gloss for good. Read once at load: GIT_GLOSS_GIT_TIMEOUT overrides;
+// a value that is not a non-negative number is ignored.
+// A timed-out git gets SIGTERM, not SIGKILL: git removes its lock files
+// (index.lock, a ref's .lock) on SIGTERM, while SIGKILL would leave one that
+// fails every later command. A git that ignores SIGTERM is waited for, with
+// no second-stage kill (execFileSync only returns when the child ends), so
+// such a git still hangs git-gloss.
+// Network calls (fetch, push, ls-remote) get NETWORK_TIMEOUT (600 s) instead:
+// a slow link would otherwise fail at 120 s and every retry would fail again.
+// GIT_GLOSS_NETWORK_TIMEOUT (ms, 0 = none) sets that limit alone; failing it,
+// GIT_GLOSS_GIT_TIMEOUT, when set, applies to both.
+export function parseGitTimeout(raw, fallback = 120_000) {
+    const n = raw === undefined || raw.trim() === '' ? NaN : Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+const GIT_TIMEOUT = parseGitTimeout(process.env.GIT_GLOSS_GIT_TIMEOUT);
+export const NETWORK_TIMEOUT = parseGitTimeout(process.env.GIT_GLOSS_NETWORK_TIMEOUT, parseGitTimeout(process.env.GIT_GLOSS_GIT_TIMEOUT, 600_000));
+export function git(args, input, env = {}, limit = GIT_TIMEOUT) {
     try {
         return execFileSync('git', args, {
+            timeout: limit,
+            killSignal: 'SIGTERM',
             encoding: 'utf8',
             input,
             // Untranslated messages: readNote recognises "no note found" by its text.
@@ -34,17 +57,45 @@ export function git(args, input, env = {}) {
         });
     }
     catch (err) {
+        if (err.code === 'ETIMEDOUT') {
+            const what = plain(args.slice(0, 3).join(' ')).slice(0, 80);
+            const t = new GitError(`git ${what} timed out after ${limit / 1000} s (set GIT_GLOSS_GIT_TIMEOUT to change the limit)`);
+            t.timedOut = true;
+            throw t;
+        }
         const stderr = err.stderr?.trim();
         const e = new GitError(stderr || `git ${args.join(' ')} failed`);
         e.status = typeof err.status === 'number' ? err.status : undefined;
         throw e;
     }
 }
-export function gitTry(args, input) {
+// For a catch that turns a git failure into a value ("no gloss", "unreadable",
+// "use the defaults"): a git killed at the time limit gave no answer, so the
+// timeout goes on to the caller rather than become that value.
+export function rethrowTimeout(err) {
+    if (err instanceof GitError && err.timedOut)
+        throw err;
+}
+// Best-effort cleanup (a temporary ref in a `finally`, or after success): never
+// throws, not even on a timeout, so it can't fail a finished job or replace the
+// first error. A timeout leaves one warning line.
+export function gitCleanup(args) {
     try {
-        return git(args, input);
+        git(args);
     }
-    catch {
+    catch (err) {
+        if (err instanceof GitError && err.timedOut)
+            process.stderr.write(`warning: cleanup timed out, a temporary ref may be left (git ${args.join(' ')})\n`);
+    }
+}
+export function gitTry(args, input, limit = GIT_TIMEOUT) {
+    try {
+        return git(args, input, {}, limit);
+    }
+    catch (err) {
+        // Any failure is "no" (callers probe with this), but a git killed at the
+        // time limit gave no answer: say so rather than let it read as "no".
+        rethrowTimeout(err);
         return null;
     }
 }
@@ -59,11 +110,30 @@ const looksSensitive = (path) => SENSITIVE.some((re) => re.test(path.split('/').
 // untracked files except ignored ones and ones that look like secrets. Built
 // in a temporary index so the real index is untouched. `excluded` lists the
 // untracked files left out as possible secrets.
-function workingTree() {
+const READ_ONLY_MAX_UNTRACKED = 5000;
+// One deadline for the whole read-only check, every git call in it included.
+const READ_ONLY_TOTAL_MS = 10_000;
+class TooBig extends Error {
+}
+// A git runner for the read-only check: every call gets what is left of one total deadline
+// (none left: TooBig), and never more than the usual limit.
+function deadlineRun(totalMs) {
+    const end = Date.now() + totalMs;
+    return (args, env = {}) => {
+        const left = end - Date.now();
+        if (left <= 0)
+            throw new TooBig();
+        return git(args, undefined, env, GIT_TIMEOUT ? Math.min(left, GIT_TIMEOUT) : left);
+    };
+}
+// `bounded`: the read-only check (see wipStaleness): its runner, and nothing is written to the repo.
+function workingTree(bounded) {
     const dir = mkdtempSync(join(tmpdir(), 'git-gloss-index-'));
+    const readOnly = !!bounded;
+    const run = bounded ?? ((args, env = {}) => git(args, undefined, env));
     try {
         const index = join(dir, 'index');
-        const real = git(['rev-parse', '--path-format=absolute', '--git-path', 'index']).trim();
+        const real = run(['rev-parse', '--path-format=absolute', '--git-path', 'index']).trim();
         if (existsSync(real)) {
             copyFileSync(real, index);
             // Keep the index's timestamps: git compares them with file mtimes to
@@ -73,12 +143,20 @@ function workingTree() {
             utimesSync(index, atime, mtime);
         }
         const env = { GIT_INDEX_FILE: index };
-        const untracked = git(['ls-files', '--others', '--exclude-standard', '-z', '--', ':/']).split('\0').filter(Boolean);
+        const untracked = run(['ls-files', '--others', '--exclude-standard', '-z', '--', ':/']).split('\0').filter(Boolean);
         const excluded = untracked.filter(looksSensitive);
-        git(['add', '-A', '--', ':/'], undefined, env);
+        if (readOnly) {
+            if (untracked.length > READ_ONLY_MAX_UNTRACKED)
+                throw new TooBig();
+            // New objects go to the temporary directory (removed below); the repo's own are only read.
+            mkdirSync(join(dir, 'objects'));
+            env.GIT_OBJECT_DIRECTORY = join(dir, 'objects');
+            env.GIT_ALTERNATE_OBJECT_DIRECTORIES = run(['rev-parse', '--path-format=absolute', '--git-path', 'objects']).trim();
+        }
+        run(['add', '-A', '--', ':/'], env);
         if (excluded.length)
-            git(['rm', '-q', '--cached', '--', ...excluded.map((p) => `:/${p}`)], undefined, env);
-        return { tree: git(['write-tree'], undefined, env).trim(), excluded };
+            run(['rm', '-q', '--cached', '--', ...excluded.map((p) => `:/${p}`)], env);
+        return { tree: run(['write-tree'], env).trim(), excluded };
     }
     finally {
         rmSync(dir, { recursive: true, force: true });
@@ -139,13 +217,35 @@ export function archiveSnapshot(sha) {
 export const dropWipNote = (sha) => gitTry(['notes', '--ref', WIP_NOTES_REF, 'remove', '--ignore-missing', sha]);
 export const isWipSnapshot = (sha) => gitTry(['log', '-1', '--format=%s', sha])?.trim() === WIP_MESSAGE;
 // Why the latest snapshot no longer matches the working tree, or null.
-export function wipStaleness(sha) {
-    const s = treeAndParent(sha);
-    if (s.parent !== headSha())
-        return 'HEAD has moved since this snapshot was taken';
-    if (workingTree().tree !== s.tree)
-        return 'the working tree has changed since this snapshot was taken';
-    return null;
+// `readOnly` (the ary server): writes nothing to the repository (the check's objects go to a
+// temporary directory), and ONE total deadline covers every git call in it. If that runs out, or
+// git fails, or the tree is too big, the answer is undefined ("could not check"): it is advisory.
+export function wipStaleness(sha, readOnly = false) {
+    if (!readOnly) {
+        const s = treeAndParent(sha);
+        if (s.parent !== headSha())
+            return 'HEAD has moved since this snapshot was taken';
+        return workingTree().tree !== s.tree ? 'the working tree has changed since this snapshot was taken' : null;
+    }
+    try {
+        const run = deadlineRun(READ_ONLY_TOTAL_MS);
+        const [tree, parent] = run(['log', '-1', '--format=%T %P', sha]).trim().split(' ');
+        let head = null; // no commits yet: no HEAD
+        try {
+            head = run(['rev-parse', '--verify', '--quiet', 'HEAD']).trim();
+        }
+        catch (err) {
+            rethrowTimeout(err);
+            if (err instanceof TooBig)
+                throw err;
+        }
+        if ((parent || null) !== (head || null))
+            return 'HEAD has moved since this snapshot was taken';
+        return workingTree(run).tree !== tree ? 'the working tree has changed since this snapshot was taken' : null;
+    }
+    catch {
+        return undefined;
+    }
 }
 // The diff of uncommitted work against HEAD, as a snapshot would have it,
 // without taking a snapshot: no ref is written (only objects). Hunk ids match
@@ -185,19 +285,28 @@ export function resolveCommit(rev) {
 // Merges are not reviewed (their first-parent diff repeats the merged
 // commits) but are returned so views can say they were skipped: a merge can
 // still carry conflict resolutions or edits of its own.
-export function resolveCommits(arg) {
+// `newest`: keep only the newest that many non-merge commits (and the merges since the oldest of
+// them); `total` is how many there were. The rev-list still walks the whole range.
+export function resolveCommits(arg, newest = Infinity) {
     if (!arg.includes('..'))
-        return { shas: [resolveCommit(arg)], merges: [], range: null };
+        return { shas: [resolveCommit(arg)], merges: [], range: null, total: 1 };
     if (arg.includes('...')) {
         throw new GitError(`${arg}: "..." includes commits from both sides; use A..B for the commits on B since A`);
     }
     // --end-of-options: the argument is a revision range, never an option.
     const list = (...flags) => git(['rev-list', '--reverse', ...flags, '--end-of-options', arg, '--']).split('\n').filter(Boolean);
-    const shas = list('--no-merges');
-    const merges = list('--merges');
-    if (!shas.length && !merges.length)
+    const plain = list('--no-merges');
+    let merges = list('--merges');
+    if (!plain.length && !merges.length)
         throw new GitError(`no commits in ${arg}`);
-    return { shas, merges, range: arg };
+    const shas = plain.slice(-newest);
+    if (shas.length < plain.length) {
+        // Keep the merges after the oldest shown commit, in the order of the whole range.
+        const all = list();
+        const keep = new Set(all.slice(all.indexOf(shas[0])));
+        merges = merges.filter((c) => keep.has(c));
+    }
+    return { shas, merges, range: arg, total: plain.length };
 }
 export function commitSubject(sha) {
     return git(['log', '-1', '--format=%s', sha]).trim();
@@ -238,12 +347,22 @@ function cleanStrings(v) {
         return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, cleanStrings(x)]));
     return v;
 }
+// A note's total size, which no other cap bounds (each cost is linear in it, but
+// 60 MB took seconds, and the hunk records are not capped by count).
+export const noteSizeProblem = (bytes) => bytes > MAX_NOTE_BYTES ? `${(bytes / 1024 / 1024).toFixed(1)} MiB, over the size limit of ${MAX_NOTE_BYTES / 1024 / 1024} MiB (MAX_NOTE_BYTES in src/schema.ts)` : null;
 export function readNote(sha) {
     // A commit's gloss, or a wip snapshot's (they are never the same object).
     const raw = rawNote(NOTES_REF, sha) ?? rawNote(WIP_NOTES_REF, sha);
     if (raw === null)
         return null;
-    const at = `the gloss on ${sha.slice(0, 10)}`;
+    return parseNote(raw, `the gloss on ${sha.slice(0, 10)}`);
+}
+// A stored gloss's text as a note, or a GlossError saying why it can't be one
+// (`at` names it in the message). Also used for glosses read from the notes history.
+export function parseNote(raw, at) {
+    const big = noteSizeProblem(Buffer.byteLength(raw));
+    if (big)
+        throw new GlossError(`${at} is ${big}; replace it with \`git gloss add --force\``);
     let data;
     try {
         data = JSON.parse(raw);
@@ -268,7 +387,12 @@ export function readNote(sha) {
     return { ...data, annotation: cleanStrings(annotation.data) };
 }
 export function writeNote(sha, note, ref = NOTES_REF) {
-    git(['notes', '--ref', ref, 'add', '-f', '-F', '-', sha], JSON.stringify(note, null, 2) + '\n');
+    const text = JSON.stringify(note, null, 2) + '\n';
+    // Readers refuse a bigger note, so it is not written.
+    const big = noteSizeProblem(Buffer.byteLength(text));
+    if (big)
+        throw new GlossError(`the gloss is ${big}; write less text, or fewer or smaller groups`);
+    git(['notes', '--ref', ref, 'add', '-f', '-F', '-', sha], text);
 }
 // The commits that changed lines start..end of `file`, newest first, starting
 // from `commit`, following them through edits, moves within the file and

package/dist/html/client.js

@@ -264,6 +264,13 @@
     var f = r.state === 'seen' ? 'current' : r.state === 'code-changed' ? 'code changed since review' : 'gloss changed since review'
     return v + ' · ' + f
   }
+  // How far the arbiter got with a stage's latest review, for a rail row: nothing unless it found issues.
+  function decidedShort(r) {
+    // reviewStatus() in src/reviews.ts sorts each stage newest-first, and the page data keeps that order.
+    var latest = r.entries[0]
+    if (!latest || !latest.decisions || latest.verdict === 'clean') return ''
+    return latest.complete ? ' \u00b7 complete' : latest.decisionCount ? ' \u00b7 ' + latest.decisionCount + ' decided' : ' \u00b7 undecided'
+  }
   // One compact row per stage; each opens the Reviews view in the main pane.
   function reviewStatus(c) {
     var ci = commits.indexOf(c)
@@ -274,7 +281,7 @@
       var b = button('rvrow', null, function () { selectReviews(ci, r.stage) })
       b.setAttribute('data-fid', 'rv:' + ci + ':' + r.stage)
       b.title = r.phrase
-      add(b, el('span', 'rvdot ' + (cls === 'review-ok' ? 'ok' : cls === 'stale' ? 'warn' : 'none')), el('span', 'rvstage', r.stage), el('span', 'rvtxt', reviewShort(r)),
+      add(b, el('span', 'rvdot ' + (cls === 'review-ok' ? 'ok' : cls === 'stale' ? 'warn' : 'none')), el('span', 'rvstage', r.stage), el('span', 'rvtxt', reviewShort(r) + decidedShort(r)),
         el('span', 'rvn', r.entries.length))
       box.appendChild(b)
     })
@@ -342,6 +349,9 @@
         if (!top || top.indent < indent || top.list.tagName.toLowerCase() !== tag) {
           if (top && top.indent === indent) stack.pop()
           var list = el(tag)
+          // A numbered list starts at its first item's number, so "5. 6." is not shown as "1. 2.".
+          var first = tag === 'ol' ? parseInt(m[2], 10) : 0
+          if (first > 0 && first < 100000 && first !== 1) list.start = first
           if (stack.length && stack[stack.length - 1].li) stack[stack.length - 1].li.appendChild(list); else root.appendChild(list)
           top = { indent: indent, list: list, li: null }
           stack.push(top)
@@ -376,6 +386,25 @@
     if (v) add(head, el('span', 'chip ' + (v === 'ISSUES' ? 'bad' : 'good'), v === 'ISSUES' ? 'issues found' : 'no issues'))
     return head
   }
+  // What was decided about one review: the summary, then a row per decision. Text only, never markup.
+  function decisionsBlock(e) {
+    if (!e.decisions) return null
+    var box = el('div', 'decisions')
+    add(box, el('h3', 'dhead', 'Decisions'), el('p', 'dsum', e.summary))
+    if (e.decisionCount > e.decisions.length) add(box, el('p', 'muted dhidden', 'showing the latest ' + e.decisions.length + ' of ' + e.decisionCount))
+    if (e.decisions.length) {
+      var ul = el('ul', 'dlist')
+      e.decisions.forEach(function (d) {
+        var row = el('li', 'drow')
+        add(row, el('span', 'chip dchip ' + d.outcome, d.outcome), text(' '), el('span', 'dfinding', d.finding))
+        if (d.note) add(row, text(' \u2014 '), el('span', 'dnote', d.note))
+        add(row, text(' '), el('span', 'muted dby', d.by + ', ' + d.at.slice(0, 10)))
+        ul.appendChild(row)
+      })
+      add(box, ul)
+    }
+    return box
+  }
   function reviewsPane(c, stage) {
     var pane = el('div')
     add(pane, button('btn small back', '‹ Back', goBack))
@@ -387,10 +416,10 @@
       add(sec, el('h2', null, r.stage), add(el('p', 'rvsum'), el('span', reviewClass(r), r.phrase)))
       var entries = r.entries.slice().sort(function (a, b) { return a.at < b.at ? 1 : a.at > b.at ? -1 : 0 })
       entries.forEach(function (e, i) {
-        if (i === 0) add(sec, add(el('div', 'entry'), entryHead(e), markdown(e.findings)))
+        if (i === 0) add(sec, add(el('div', 'entry'), entryHead(e), decisionsBlock(e), markdown(e.findings)))
         else {
           var d = el('details', 'entry old')
-          add(d, add(el('summary'), entryHead(e)), markdown(e.findings))
+          add(d, add(el('summary'), entryHead(e)), decisionsBlock(e), markdown(e.findings))
           add(sec, d)
         }
       })
@@ -463,8 +492,10 @@
     if (!multi && state.kind === 'group' && dir < 0 && !neighbor(-1)) { selectKind(0, 'overview'); return }
     if (multi && state.kind !== 'group') {
       var order = commitOrder()
-      var next = order[order.indexOf(state.ci) + dir]
-      if (next !== undefined) selectKind(next, 'overview')
+      // The nearest commit the filter shows, not one it hides.
+      for (var j = order.indexOf(state.ci) + dir; j >= 0 && j < order.length; j += dir) {
+        if (!commitHidden(order[j])) { selectKind(order[j], 'overview'); break }
+      }
       return
     }
     var id = neighbor(dir)
@@ -624,6 +655,7 @@
   function unannotatedBox(c) {
     var box = add(el('div', 'unannotated'), el('p', null, c.glossed
       ? 'These changes are in the commit but no group explains them.'
+      : c.glossRefused ? 'This commit\'s gloss was refused, so nothing explains these changes.'
       : 'This commit has no gloss, so nothing explains these changes.'))
     c.unannotated.forEach(function (h) { box.appendChild(hunkView(c, h, 'un')) })
     return box
@@ -685,17 +717,18 @@
     if (multi) add(pane, el('div', 'eyebrow', 'Commit ' + (ci + 1) + ' of ' + commits.length + ' · ' + new Date(c.date).toLocaleDateString()))
     add(pane, el('h1', 'title', c.subject), commitMeta(c))
     if (!c.glossed) {
-      var w = add(el('section', 'warnbox'), el('div', 't', 'No gloss on this commit'),
+      var w = add(el('section', 'warnbox'), el('div', 't', c.glossRefused ? 'Gloss refused on this commit' : 'No gloss on this commit'),
+        c.glossRefused ? el('p', null, 'The gloss on this commit was refused: ' + c.glossRefused) : null,
         el('p', null, 'Its whole diff is unannotated, so there is no attention level, no groups and no reasons to read.'),
-        el('p', 'cmd', 'git gloss add ' + sha7(c)))
+        el('p', 'cmd', 'git gloss add ' + sha7(c) + (c.glossRefused ? ' --force' : '')))
       add(pane, w)
       add(pane, changesHead('Changes (' + c.unannotated.length + ')'), unannotatedBox(c))
       return pane
     }
     warnings(c, pane)
-    add(pane, attentionCard(c))
     statement(pane, 'Task', c.task)
     statement(pane, 'Summary', c.summary)
+    add(pane, attentionCard(c))
     focusSection(c, ci, pane)
     if (c.groups.length) {
       var nb = necessityBar(c)
@@ -924,7 +957,7 @@
     })
     var box = add(el('div', 'sum'), el('div', 'eyebrow', 'Range at a glance'), strip, line)
     var top = commits[order[0]]
-    if (levelOf(top).level) {
+    if (top && levelOf(top).level) {
       var link = el('a', null, sha7(top) + ' ' + top.subject)
       link.href = '#c-' + sha7(top)
       link.addEventListener('click', function (ev) { ev.preventDefault(); selectKind(order[0], 'overview') })
@@ -933,13 +966,51 @@
     return box
   }
 
+  // The box above a range's commit list. Matching is plain text (lower-cased `includes` on the
+  // short sha, subject and author), never a pattern or markup. The one input is kept across
+  // re-renders so what was typed stays; it is not saved anywhere, so a reload clears it.
+  var railRows = []
+  var filterBox = null
+  var noMatch = el('div', 'emptyrows', 'No commits match.')
+  function commitHidden(ci) {
+    return railRows.some(function (r) { return r.ci === ci && r.node.hidden })
+  }
+  function applyCommitFilter() {
+    var q = filterBox.value.trim().toLowerCase()
+    var shown = 0
+    railRows.forEach(function (r) {
+      var hit = !q || r.text.indexOf(q) >= 0
+      r.node.hidden = !hit
+      if (hit) shown++
+    })
+    noMatch.hidden = !q || !!shown
+  }
+  function commitFilter() {
+    if (!filterBox) {
+      filterBox = el('input')
+      filterBox.type = 'search'
+      filterBox.spellcheck = false
+      filterBox.placeholder = 'Filter commits'
+      filterBox.setAttribute('aria-label', 'Filter commits by message, author or sha')
+      filterBox.addEventListener('input', applyCommitFilter)
+    }
+    return add(el('div', 'cfilter'), filterBox, noMatch)
+  }
+
   function renderRail() {
     railEl.textContent = ''
     if (multi) {
       add(railEl, railSummary(), add(el('div', 'railhead'), el('div', 'eyebrow', state.hot ? 'Hottest first, then newest' : 'Newest first')))
       var list = el('div', 'commits')
-      commitOrder().forEach(function (ci) { list.appendChild(commitRow(ci)) })
-      add(railEl, list)
+      railRows = []
+      commitOrder().forEach(function (ci) {
+        var row = commitRow(ci)
+        var c = commits[ci]
+        railRows.push({ ci: ci, node: row, text: (sha7(c) + ' ' + c.subject + ' ' + c.author).toLowerCase() })
+        list.appendChild(row)
+      })
+      add(railEl, commitFilter(), list)
+      applyCommitFilter()
       if (data.merges.length) {
         var ml = add(el('div', 'mergelist'), el('div', 'eyebrow', 'Merges, not reviewed'))
         data.merges.forEach(function (m) { ml.appendChild(add(el('div'), el('span', 'mono', m.sha.slice(0, 7)), text(' ' + m.subject))) })

package/dist/html/data.js

@@ -1,19 +1,42 @@
 import { commitDiff, commitSubject, git } from '../git.js';
-import { reviewStatus, statusPhrase, verdict } from '../reviews.js';
+import { labelFindings, orderDecisions } from '../findings.js';
+import { decisionSummary, readDecisions, reviewStatus, statusPhrase, verdict } from '../reviews.js';
 import { parseDiff } from '../diff.js';
-import { loadGloss } from '../loader.js';
+import { loadGlossInRange, loadGloss, refusedWarning } from '../loader.js';
+import { plain } from '../plain.js';
 import { belowFloor } from '../render.js';
 import { showsImpact, tryAnalyze } from '../floor.js';
 import { bodyLines, changedCount, gapText, isGap, refLabel, slice, sliceStats } from '../selection.js';
 import { IMPACT, IMPACT_HELP, NECESSITY, NECESSITY_HELP, servesOf } from '../schema.js';
+// The most decisions listed per review (the newest); the summary counts all of them.
+export const MAX_PAGE_DECISIONS = 200;
+// The page shows commit text as it shows a terminal's: without escape sequences or characters that reorder or hide text.
+const authorAndDate = (sha) => {
+    const [author, date] = git(['log', '-1', '--format=%an%x00%aI', sha]).trim().split('\0');
+    return [plain(author), plain(date)];
+};
 function pageReviews(sha) {
+    const all = readDecisions(sha);
     return reviewStatus(sha).map((s) => ({
         stage: s.stage,
         state: s.code === 'changed' ? 'code-changed'
             : (s.stage === 'honesty' || s.stage === 'improve') && s.gloss === 'changed' ? 'gloss-changed' : 'seen',
         verdict: verdict(s),
         phrase: statusPhrase(s),
-        entries: s.reviews.map((r) => ({ agent: r.agent, model: r.model, mode: r.mode, at: r.at, target: r.target, findings: r.findings })),
+        entries: s.reviews.map((r) => {
+            const entry = { id: r.id, agent: r.agent, model: r.model, mode: r.mode, at: r.at, target: r.target, findings: labelFindings(r.findings) };
+            const ds = all.filter((d) => d.review === r.id);
+            if (r.verdict === 'clean' && !ds.length)
+                return entry;
+            // Sorted here only to pick the newest MAX_PAGE_DECISIONS; orderDecisions sets the order shown.
+            const done = ds.filter((d) => d.outcome).sort((a, b) => a.at.localeCompare(b.at));
+            entry.decisions = orderDecisions(done.slice(-MAX_PAGE_DECISIONS)).map((d) => ({ outcome: d.outcome, finding: plain(d.finding), ...(d.note ? { note: plain(d.note) } : {}), by: plain(d.by), at: plain(d.at) }));
+            entry.complete = ds.some((d) => d.complete);
+            entry.summary = decisionSummary(ds);
+            entry.verdict = r.verdict;
+            entry.decisionCount = done.length;
+            return entry;
+        }),
     }));
 }
 // The lines to show for a selection: the @@ header, then the slice, with
@@ -71,7 +94,7 @@ export function reviewOrder(groups, focus = []) {
 }
 const allLines = (h) => Array.from({ length: changedCount(h) }, (_, i) => i + 1);
 export function commitData(gloss) {
-    const [author, date] = git(['log', '-1', '--format=%an%x00%aI', gloss.sha]).trim().split('\0');
+    const [author, date] = authorAndDate(gloss.sha);
     const a = gloss.note.annotation;
     const an = tryAnalyze(gloss);
     // Same threshold as `show`: derived impact badges only where the diff puts a group above module.
@@ -120,7 +143,7 @@ export function commitData(gloss) {
         .sort((x, y) => NECESSITY.indexOf(x.necessity) - NECESSITY.indexOf(y.necessity));
     return {
         sha: gloss.sha,
-        subject: gloss.subject,
+        subject: plain(gloss.subject),
         author,
         date,
         glossed: true,
@@ -137,14 +160,15 @@ export function commitData(gloss) {
         reviews: pageReviews(gloss.sha),
     };
 }
-function unglossedData(sha) {
-    const [author, date] = git(['log', '-1', '--format=%an%x00%aI', sha]).trim().split('\0');
+function unglossedData(sha, refused) {
+    const [author, date] = authorAndDate(sha);
     return {
         sha,
-        subject: commitSubject(sha),
+        subject: plain(commitSubject(sha)),
         author,
         date,
         glossed: false,
+        ...(refused ? { glossRefused: plain(refused).slice(0, 300) } : {}),
         task: '',
         attention: null,
         computed: null,
@@ -160,12 +184,15 @@ function unglossedData(sha) {
 export function buildPageData(shas, range = null, merges = []) {
     return {
         range,
-        merges: merges.map((sha) => ({ sha, subject: commitSubject(sha) })),
+        merges: merges.map((sha) => ({ sha, subject: plain(commitSubject(sha)) })),
         necessity: NECESSITY.map((name) => ({ name, help: NECESSITY_HELP[name] })),
         impact: IMPACT.map((name) => ({ name, help: IMPACT_HELP[name] })),
         commits: shas.map((sha) => {
-            const gloss = loadGloss(sha);
-            return gloss ? commitData(gloss) : unglossedData(sha);
+            // In a range, a refused gloss is skipped (with a warning) like an unglossed commit.
+            const { gloss, refused } = range ? loadGlossInRange(sha) : { gloss: loadGloss(sha), refused: undefined };
+            if (refused)
+                console.error(refusedWarning(sha, refused));
+            return gloss ? commitData(gloss) : unglossedData(sha, refused);
         }),
         generated: new Date().toISOString(),
     };

package/dist/html/style.css

@@ -123,6 +123,7 @@ kbd { font-family: var(--mono); font-size: 11px; border: 1px solid var(--line);
 .ary-bar { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 14px; min-width: 0; }
 .ary-repo { color: var(--muted); font-family: var(--mono); font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 200px; }
 .ary-field { display: flex; align-items: center; gap: 6px; color: var(--muted); font-size: 12px; }
+.ary-wip { font-size: 13px; }
 .ary-notice { flex-basis: 100%; margin: 0; padding: 6px 10px; border-radius: 8px; border: 1px dashed var(--warn); font-size: 13px; color: var(--ink); }
 .combo { position: relative; }
 .combo-btn, .combo-panel input, .ary-rev input { border: 1px solid var(--line); background: var(--panel); color: var(--ink); border-radius: 8px; min-height: 36px; padding: 4px 12px; font-size: 13px; }
@@ -220,6 +221,9 @@ button.chip { min-height: 32px; }
 .strip i.none { background: transparent; border: 1.5px dashed var(--attention-none); }
 .commits { display: flex; flex-direction: column; padding: 0 8px 16px; }
 .crow { margin-bottom: 2px; }
+.crow[hidden] { display: none; }
+.cfilter { padding: 0 8px 8px; }
+.cfilter input { width: 100%; box-sizing: border-box; border: 1px solid var(--line); background: var(--panel); color: var(--ink); border-radius: 8px; min-height: 36px; padding: 4px 12px; font-size: 13px; }
 .crow > .pick { display: block; width: 100%; border: 1px solid transparent; border-radius: 8px; padding: 10px 12px; min-height: 64px; }
 .crow.sel > .pick { background: var(--accent-soft); border-color: var(--accent); }
 .rtop { display: flex; align-items: center; gap: 10px; }
@@ -340,6 +344,18 @@ tr.gap td { background: var(--bg); color: var(--muted); font-style: italic; font
 .chip.good { color: var(--ok); border-color: var(--ok); }
 .chip.bad { color: var(--warn); border-color: var(--warn); }
 
+/* Decisions on a review: the outcome differs by its word and its border, not by colour alone */
+.decisions { margin: 0 0 12px; }
+.dhead { margin: 0 0 2px; font-size: 13px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); }
+.dsum { margin: 0 0 6px; }
+.dlist { list-style: none; margin: 0; padding: 0; }
+.drow { padding: 4px 0; overflow-wrap: anywhere; }
+.dchip { font-size: 12px; padding: 0 8px; }
+.dchip.fixed { color: var(--ok); border-color: var(--ok); border-style: solid; }
+.dchip.follow-up { border-style: dashed; }
+.dchip.rejected { border-style: dotted; text-decoration: line-through; }
+.dchip.accepted { border-style: double; border-width: 3px; }
+
 /* Rendered markdown */
 .md { max-width: 75ch; overflow-wrap: anywhere; }
 .md p { margin: 0 0 10px; }

package/dist/loader.js

@@ -1,4 +1,5 @@
-import { commitDiff, commitSubject, GlossError, readNote } from './git.js';
+import { commitDiff, commitSubject, GitError, GlossError, readNote } from './git.js';
+import { plain } from './plain.js';
 import { parseDiff } from './diff.js';
 import { changedCount, claimsProblem, selections, uncovered } from './selection.js';
 const locationKey = (h) => [h.file, h.oldFile ?? '', h.oldStart, h.oldLines, h.newStart, h.newLines].join('\0');
@@ -37,8 +38,11 @@ export function matchHunks(stored, current) {
 // the wrong code under a group without anyone noticing.
 export function loadGloss(sha) {
     const note = readNote(sha);
-    if (!note)
-        return null;
+    return note && loadGlossOf(sha, note);
+}
+// The same, for a note already read: what `versions --restore` checks a version
+// with before it becomes the gloss, so it can never restore what readers refuse.
+export function loadGlossOf(sha, note) {
     const current = parseDiff(commitDiff(sha));
     const resolved = matchHunks(note.hunks, current);
     const groups = note.annotation.groups.map((group) => ({
@@ -64,3 +68,18 @@ export function loadGloss(sha) {
     }
     return { sha, subject: commitSubject(sha), note, hunks: current, groups, unannotated, stale: warnings.length > 0, warnings };
 }
+// For a range: a commit whose gloss is refused (too big, malformed, over the
+// caps, claims too many lines) is skipped like an unglossed one, and the
+// reason comes back for the caller to warn about, so one hostile note does not
+// fail the whole range. A git failure or timeout is not a refusal and still throws.
+export function loadGlossInRange(sha) {
+    try {
+        return { gloss: loadGloss(sha) };
+    }
+    catch (err) {
+        if (!(err instanceof GlossError) || err instanceof GitError)
+            throw err;
+        return { gloss: null, refused: err.message };
+    }
+}
+export const refusedWarning = (sha, why) => `warning: skipping the gloss on ${sha.slice(0, 10)}, which ${plain(why).replace(/^the gloss on \S+ /, '')}`;

package/dist/plain.js

@@ -5,5 +5,6 @@ export function plain(text, multiline = false) {
         // OSC (ended by BEL or ESC \) and CSI sequences, then any lone ESC and control characters (newline and tab kept when multiline).
         .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, '')
         .replace(/\x1b\[[0-?]*[ -/]*[@-~]?/g, '')
-        .replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, (c) => (multiline && (c === '\n' || c === '\t') ? c : ' '));
+        // Also the invisible format characters that reorder or hide text: LRM, RLM, ALM (U+200E, U+200F, U+061C), zero-width space (U+200B), word joiner and invisible operators (U+2060-U+2064), BOM (U+FEFF), the Mongolian vowel separator (U+180E) and tag characters (U+E0000-U+E007F). U+200C (ZWNJ) and U+200D (ZWJ) are kept: stripping them would mangle valid text (Persian words, emoji sequences), and they reorder or hide nothing. The soft hyphen (U+00AD) is kept too: it hides no text. The html page does not use plain().
+        .replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029\u202a-\u202e\u2066-\u2069\u200b\u200e\u200f\u061c\u180e\u2060-\u2064\ufeff\u{e0000}-\u{e007f}]/gu, (c) => (multiline && (c === '\n' || c === '\t') ? c : ' '));
 }