cctally 1.80.3 → 1.81.0

package/bin/_cctally_dashboard.py

@@ -1090,16 +1090,23 @@ def _build_claude_source_detail(
 
 
 def build_source_detail(*, snapshot, source: str, resource: str,
-                        key: str, window_weeks: int = 4) -> dict[str, Any]:
+                        key: str, window_weeks: int = 4,
+                        account: "str | None" = None) -> dict[str, Any]:
     """Resolve one qualified opaque key to a provider-native read-only detail.
 
     The frozen published bundle is the first bounded key index.  Claude then
     invokes the existing detail builders with cache-only reads; Codex returns
     the native S1-S3 adapter detail without a Claude fallback or a rollout
     parse.  Every branch preserves the generic handler errors above it.
+
+    ``account`` (#341 Task 4): the modal-captured account qualifier. When set,
+    ``source_detail_lookup`` verifies row ownership before returning, so an
+    account-focused modal can never surface another account's row.
     """
     try:
-        row = source_detail_lookup(snapshot.source_bundle, source, resource, key)
+        row = source_detail_lookup(
+            snapshot.source_bundle, source, resource, key, account=account,
+        )
     except SourceResourceNotFound:
         # A Claude project drill can expose a recent session outside the
         # dashboard panel's bounded published slice.  The provider adapter
@@ -2131,7 +2138,8 @@ def _dashboard_build_weekly_periods(conn: "sqlite3.Connection",
     """
     range_end = now_utc
     range_start = now_utc - dt.timedelta(days=7 * (n + 1))
-    weeks = _compute_subscription_weeks(conn, range_start, range_end)
+    weeks = _compute_subscription_weeks(conn, range_start, range_end,
+                                        account_key=None)  # #341: merged read
     if not weeks:
         return []
     fetch_start = min(
@@ -6062,11 +6070,28 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             "resource": resource,
             "key": key,
         }
+        query = _urlparse.parse_qs(
+            _urlparse.urlsplit(self.path).query,
+            keep_blank_values=True,
+        )
+        # #341 Task 4 (spec §4 finding 10): the account qualifier the modal
+        # captured at open. When present, the detail lookup verifies row
+        # ownership so an account-focused modal never surfaces another account's
+        # row. Absent = today's account-agnostic behavior. Validate the shape (a
+        # 32-hex account_key or a reserved sentinel) before it reaches the reader.
+        raw_account = query.get("account")
+        if raw_account is not None:
+            if (
+                len(raw_account) != 1
+                or not re.fullmatch(r"[0-9a-f]{32}|unattributed|\*", raw_account[0])
+            ):
+                self._respond_json(400, {
+                    "code": "source_capability_unavailable",
+                    "error": "source capability unavailable",
+                })
+                return
+            detail_kwargs["account"] = raw_account[0]
         if resource == "project":
-            query = _urlparse.parse_qs(
-                _urlparse.urlsplit(self.path).query,
-                keep_blank_values=True,
-            )
             raw_weeks = query.get("weeks")
             if raw_weeks is not None:
                 if len(raw_weeks) != 1 or raw_weeks[0] not in {"1", "4", "8", "12"}:

package/bin/_cctally_dashboard_conversation.py

@@ -853,8 +853,12 @@ def _make_codex_discovery_step(handler, conn, conversation_key, cq_codex):
             # the transcript cursor. Neither lock is held across the other.
             core = open_cache_db()
             try:
-                core_stats = sync_codex_cache(
-                    core, only_paths=set(to_ingest)
+                cache_mod = sys.modules["cctally"]._load_sibling("_cctally_cache")
+                core_stats, core = cache_mod._run_cache_operation_with_recovery(
+                    core,
+                    lambda active_conn: sync_codex_cache(
+                        active_conn, only_paths=set(to_ingest)
+                    ),
                 )
             finally:
                 core.close()

package/bin/_cctally_dashboard_envelope.py

@@ -788,6 +788,51 @@ def _build_alerts_envelope_array(
     return out[:limit]
 
 
+def _sync_failure_envelope(error: str | None) -> dict | None:
+    """Classify a raw server sync failure into a privacy-safe UI contract."""
+    if not error:
+        return None
+
+    text = error.casefold()
+    if (
+        "stale maintenance marker" in text
+        or "stale repair marker" in text
+        or "recovery could not claim maintenance" in text
+    ):
+        return {
+            "kind": "maintenance_stale",
+            "label": "⚠ cache repair blocked",
+            "detail": "A stale cache repair owner is blocking server sync.",
+            "action": "cctally cache-sync --rebuild",
+        }
+    if "maintenance is in progress" in text:
+        return {
+            "kind": "maintenance_active",
+            "label": "cache repair in progress",
+            "detail": "Another cctally process is repairing the server cache.",
+            "action": None,
+        }
+
+    c = sys.modules["cctally"]
+    if (
+        c._is_sqlite_corruption_error(error)
+        or "cache.db recovery" in text
+        or "cache.db is still open" in text
+    ):
+        return {
+            "kind": "cache_corruption",
+            "label": "⚠ cache recovery needed",
+            "detail": "The server cache database could not be read safely.",
+            "action": "cctally cache-sync --rebuild",
+        }
+    return {
+        "kind": "server_sync",
+        "label": "⚠ server sync error",
+        "detail": "The server could not complete its background sync.",
+        "action": None,
+    }
+
+
 def snapshot_to_envelope(snap: "DataSnapshot", *,
                          now_utc: "dt.datetime",
                          monotonic_now: "float | None" = None,
@@ -1369,6 +1414,10 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
         "last_sync_at":    None,
         "sync_age_s":      sync_age_s,
         "last_sync_error": snap.last_sync_error,
+        # Privacy-safe classification for user-facing dashboard copy. Keep the
+        # raw legacy field for API compatibility and diagnostics, but never
+        # place it in visible text/title/aria surfaces.
+        "sync_failure":    _sync_failure_envelope(snap.last_sync_error),
 
         # F1 (server-resolves "local" → IANA): the browser never has to
         # guess. {tz, resolved_tz, offset_label, offset_seconds} computed

package/bin/_cctally_dashboard_share.py

@@ -36,6 +36,7 @@ from __future__ import annotations
 import datetime as dt
 import json
 import pathlib
+import re
 import sqlite3
 import sys
 from collections.abc import Mapping
@@ -1266,6 +1267,60 @@ def _share_source_selection(req: dict) -> tuple[str, bool]:
     return source, explicit
 
 
+_ACCOUNT_KEY_RE = re.compile(r"[0-9a-f]{32}|unattributed|\*")
+
+
+def _share_account_selection(req: dict) -> "str | None":
+    """Resolve the optional captured account qualifier (#341 Task 4, spec §4).
+
+    The composer captures ``(source, account)`` at OPEN_SHARE (client
+    ``shareModal.account``) and posts the resolved account_key. A legacy request
+    (no ``account`` field, or an explicit null) stays account-agnostic — today's
+    byte-identical behavior. A malformed value is rejected so a bad qualifier
+    can never reach the reader. The account carries into the data_digest (a focus
+    change busts the composer drift check) and the response/history metadata.
+    """
+    if "account" not in req:
+        return None
+    account = req.get("account")
+    if account is None:
+        return None
+    if not isinstance(account, str) or not _ACCOUNT_KEY_RE.fullmatch(account):
+        raise ValueError("source capability unavailable")
+    return account
+
+
+def _share_account_display_label(source: str, account: "str | None",
+                                 *, reveal: bool) -> "str | None":
+    """The reveal-aware account label to stamp on a share artifact (#341 Task 4).
+
+    Resolves the account's registry label + deterministic index for its provider
+    (``all`` has no account selector) and routes both through the fail-closed
+    kernel chokepoint ``anonymize_account_label`` — so anon-mode (the default)
+    emits ``Account A/B/C`` and only an explicit reveal shows the real label.
+    Returns ``None`` when no account is captured or it cannot be resolved (never
+    guesses; never leaks). Emails are never consulted — only the label.
+    """
+    if account is None or source not in ("claude", "codex"):
+        return None
+    ls = _share_load_lib()
+    c = sys.modules["cctally"]
+    try:
+        import _cctally_account
+        conn = c._load_sibling("_cctally_core").open_db()
+        try:
+            reg = _cctally_account.load_accounts(conn, source)
+            label = _cctally_account.account_label(conn, account)
+        finally:
+            conn.close()
+    except Exception:
+        return None
+    index = next(
+        (i for i, r in enumerate(reg) if r["account_key"] == account), -1,
+    )
+    return ls.anonymize_account_label(label, index, reveal=reveal)
+
+
 def _source_state_for_share(data_snap, source: str):
     try:
         bundle = data_snap.source_bundle
@@ -1583,12 +1638,17 @@ def _share_state_domain(state, panel: str):
 
 def _share_digest_input(*, panel: str, template_id: str, source: str,
                         source_explicit: bool, states, snapshots,
-                        panel_data):
+                        panel_data, account: "str | None" = None):
+    # #341 Task 4: the captured account participates in the digest so switching
+    # the focused account registers as data drift in the composer (spec §4).
+    # Absent (legacy / account-agnostic) → omitted, so the digest is byte-stable.
+    account_key = {"account": account} if account is not None else {}
     if not source_explicit:
         return {
             "panel": panel,
             "template_id": template_id,
             "panel_data": panel_data,
+            **account_key,
         }
     providers = []
     for state, snapshot in zip(states, snapshots):
@@ -1612,6 +1672,7 @@ def _share_digest_input(*, panel: str, template_id: str, source: str,
             {"claude_panel_data": panel_data}
             if source in ("claude", "all") else {}
         ),
+        **account_key,
     }
 
 
@@ -1763,6 +1824,7 @@ def _handle_share_render_post_impl(handler) -> None:
         return
     try:
         source, source_explicit = _share_source_selection(req)
+        account = _share_account_selection(req)
     except ValueError:
         handler._respond_json(400, {
             "code": "source_capability_unavailable",
@@ -1924,6 +1986,7 @@ def _handle_share_render_post_impl(handler) -> None:
         states=source_states,
         snapshots=source_snaps,
         panel_data=panel_data,
+        account=account,
     )
     try:
         data_digest = ls._data_digest(digest_input)
@@ -1933,6 +1996,16 @@ def _handle_share_render_post_impl(handler) -> None:
         # "always drifted" rather than failing the whole render.
         data_digest = ""
 
+    # #341 Task 4: the captured account + its reveal-aware anonymized label
+    # (fail-closed via the kernel chokepoint). Present only when an account was
+    # captured, so a legacy/account-agnostic share's response is byte-stable.
+    account_label = _share_account_display_label(source, account, reveal=reveal)
+    account_meta = {}
+    if account is not None:
+        account_meta["account"] = account
+        if account_label is not None:
+            account_meta["account_label"] = account_label
+
     handler._respond_json(200, {
         "body": body,
         "content_type": content_type,
@@ -1944,6 +2017,7 @@ def _handle_share_render_post_impl(handler) -> None:
             "generated_at": _share_now_utc_iso(),
             "data_digest": data_digest,
             **({"source": source} if source_explicit else {}),
+            **account_meta,
         },
     })
 
@@ -2132,6 +2206,9 @@ def _handle_share_compose_post_impl(handler) -> None:
                 states=source_states,
                 snapshots=source_snaps,
                 panel_data=panel_data,
+                # #341 Task 4: carry the section's captured account so a
+                # focus-changed section re-digests as drift (matching render).
+                account=_share_account_selection(snap_recipe),
             ))
         except Exception:
             digest_now = ""