@ossiq/cli-linux-x64 0.1.12 → 0.1.14

package/bin/ossiq/_internal/ossiq/solver/README.md

@@ -15,6 +15,8 @@ solver/
 ├── problem.py             SolverProblem, CandidateVersion, PackageConstraint
 ├── universe.py            SolvablePool — builds SolverProblem from registry
 ├── version_matchers.py    npm semver + PEP 440 range matching — raw constraint → bool
+├── npm_range.py           npm range grammar (Lark) + node-semver's rewrite rules → comparator sets
+├── pep508.py              Which declared PyPI requirements apply to a project (extras + environment markers)
 ├── encoder.py             ConstraintEncoder — produces EncodedProblem (WCNF)
 ├── weights.py             Constraint weight constants + semver_rank_weight()
 └── dependencies_solver.py       Public API: solve_direct(), solve_transitive()
@@ -51,7 +53,8 @@ deps / transitive_records
   SolvablePool.build()          universe.py
     – deduplicates by canonical_name (highest ConstraintType priority wins)
     – fetches candidates from warm registry cache
-    – filters yanked, unpublished, prerelease (unless allowed)
+    – filters yanked, unpublished, prerelease (unless allowed), and deprecated releases when
+      allow_deprecated=False (only `ossiq add` choosing a live package passes that)
     – sorts candidates descending (newest first)
     – stamps has_cve=True on versions any of the package's CVEs affects (cves_by_package;
       judged by version_matchers.cve_affects_version, ranges included)
@@ -85,7 +88,7 @@ greedily; the pluggable RC2 driver **minimises** total violated soft cost exactl
 | L1 | Hard | — | Version outside declared `version_constraint` (PEP 440 or npm semver) |
 | L2 | Soft-Hard | `W_ENGINE = 100_000` | Engine mismatch (`python`/`node` requirement vs `engine_context`) |
 | L3 | Soft | `max(80_000 − rank × 5_000, 1_000)` | Semver-rank preference — rank 0 = latest eligible semver |
-| L4 | Soft | `W_DEPRECATED = 10_000` | Deprecated flag — penalty on selection |
+| L4 | Soft | `W_DEPRECATED = 10_000` | Deprecated flag — penalty on selection. A deprecated release still wins over a clean one that ranks two or more places below it (2 × 5 000 = 10 000), and the penalty is the same for every candidate when all are deprecated. A caller that must never get a deprecated release passes `allow_deprecated=False`, which removes them before this level applies |
 | L5 | Hard | — | CVE-affected version |
 | L6 | Soft-Hard | `W_VERY_FRESH = 100_000` | Published < 7 days ago — both direct and transitive passes |
 | L7 | — | *(reserved)* | Health score — not implemented |
@@ -116,7 +119,11 @@ Structural clauses per package (encoder):
 
 ### Version constraint dispatch (encoder.py)
 
-`version_satisfies_constraint(version, constraint, registry)` (in `version_matchers.py`) dispatches directly to PyPI (PEP 440) or npm (semver) based on the `ProjectPackagesRegistry` passed in — no exception-based fallback. Bare npm versions (e.g. `"14"`) are treated as caret ranges (`^14.0.0`). Unparseable constraints pass through (`True`) — unknown format is never a hard block.
+`version_satisfies_constraint(version, constraint, registry)` (in `version_matchers.py`) dispatches directly to PyPI (PEP 440) or npm (semver) based on the `ProjectPackagesRegistry` passed in — no exception-based fallback. npm ranges go through `npm_range.py` — a Lark grammar for the syntax plus node-semver's own rewrite rules, held to node-semver's verdicts by `tests/solver/node_semver_conformance.json`, so a partial version (`"14"`) is the X-range `14.x` exactly as npm reads it. Unparseable constraints pass through (`True`) — unknown format is never a hard block — and so does a blank one: PyPI publishes an unconstrained requirement as an empty specifier.
+
+### Which requirements apply (pep508.py)
+
+A PyPI release declares requirements gated on extras (`oauthlib<4; extra == "socialaccount"`) and on environment markers (`tomli; python_version < "3.11"`). Whether one applies depends on the project, so `RequirementScope` (`domain/`) carries the extras the project enables per package and its Python floor, and `applicable_requirements()` keeps a requirement when its marker holds in at least one environment the project can be installed into — the same stance uv's universal resolution takes. The registry (`package_version_requires`), the candidate `requires` built in `universe.py`, and the enrichment of lockfile edges all read requirements through it; the scan sets the scope once, from the lockfile's `extra = [...]` edges and `requires-python`.
 
 ---
 

package/bin/ossiq/_internal/ossiq/strategy/README.md

@@ -62,7 +62,7 @@ A strategy is not one dial, it is two, kept separate on purpose:
 
 | Tier | Base reach | Escalates to `LATEST` when... |
 |---|---|---|
-| `security` | in-range | an admitted motive is `exploitable_cve` (no in-range version clears the CVE) |
+| `security` | in-range | an admitted motive is `exploitable_cve`; the pick leaves the range only when no in-range version clears the CVE |
 | `deprecation` | in-range | an admitted motive is `exploitable_cve` or `end_of_life` |
 | `standard` | in-range | same as above |
 | `latest` | latest | already maximal |
@@ -77,7 +77,7 @@ A strategy is not one dial, it is two, kept separate on purpose:
 |---|---|---|
 | `security` | no target (no CVE) | `2.32.0` — nearest CVE-clear version |
 | `deprecation` | no target | `2.32.0` |
-| `standard` | `1.10.13` — pin admits no in-range move | `2.34.2` — newest, already CVE-clear |
+| `standard` | `1.10.26` — newest in the installed major, reported but not written (`requires_widening=True`) | `2.34.2` — newest, already CVE-clear |
 | `latest` | `2.13.5` — widens the pin, `requires_widening=True` | `2.34.2` |
 | `cutting-edge` | `2.13.5` (or newer, if a prerelease exists) | `2.34.2` |
 
@@ -109,6 +109,10 @@ A strategy is not one dial, it is two, kept separate on purpose:
 - **`escalation`** — set when reach was pushed past the tier's base `MAX_REACH` (a CVE or
   end-of-life motive escalated it), or when every reachable candidate still carries a qualifying
   CVE and the newest was picked anyway. Never silently "stay put".
+- **`widening_authorized`** — an escalating motive carried the pick past the tier's base
+  `MAX_REACH` and some reachable version clears the CVE. `plan` lists the pick as an update instead
+  of holding it under *Requires constraint widening*; `apply` still confirms the widening, unless
+  `--yes` is given. Rule 8's drift-only widening never sets it.
 
 ---
 
@@ -157,6 +161,20 @@ Filtering fresh candidates out of the ladder here makes one decision serve every
 the whole point of rule 5 in the root `CLAUDE.md`. The downstream hold survives as a backstop for
 transitive recommendations, which come from the solver's *soft* freshness penalty.
 
+**Why is the package manager's release cutoff a second filter rather than a longer cooldown?**
+uv's `exclude-newer` (and its npm-side counterparts) looks like a cooldown, but it is a different
+kind of rule. OSS IQ's cooldown is advice: one number per project, and an exploitable CVE or
+end-of-life outranks it. The package manager's cutoff is enforcement: it can differ per package
+or exempt one outright, it may be a fixed instant rather than a span, and the installer refuses a
+release past it whatever OSS IQ recommends. It also binds only on a *move*, since uv leaves an
+already-locked release past the cutoff alone. Folding the two into `max(days)` loses the
+per-package rules, and lets an escalating motive "bypass" a rule `apply` cannot bypass. So
+`select_target` takes the cutoff as its own parameter and applies it ahead of the cooldown and
+outside `escalate`. A hold it causes carries `enforced_by`, so surfaces name uv rather than OSS
+IQ. Both rules always apply, so the stricter one wins. The cutoff is not dropped from the registry
+either: facts like `latest_version` and drift stay true, and the installed version stays visible
+when it postdates the cutoff.
+
 **Why may only `latest`/`cutting-edge` cross to ESM-only, and only on a `require(esm)` Node?**
 For a CommonJS project an ESM-only release is a break whatever its version number:
 `require()` of it fails outright below Node 20.19/22.12, and above that it returns the module