cctally 1.83.0 → 1.84.0

package/bin/_cctally_dashboard.py

@@ -720,7 +720,22 @@ def _build_codex_block_detail(context, observations, *, key: str) -> dict[str, A
         and observation.identity.logical_limit_key == matched[1]
         and observation.identity.observed_slot == matched[2]
         and observation.identity.window_minutes == matched[3]
-        and observation.resets_at == reset_at
+        # CANONICAL, never the raw reset (#416 §4.1). `quota_window_blocks
+        # .resets_at_utc` — which `matched[5]` is — became the tolerance-anchored
+        # anchor, so a raw comparison here is no longer the same axis: it keeps
+        # only the members that happen to spell their reset the way the anchor
+        # does, and `block.observations`, `percent_milestones`,
+        # `quota_freshness` and `forecast_quota` are then all recomputed from
+        # that truncated set — reintroducing the very fragmentation §4.1
+        # removes. It is also a 404 generator: this read is BOUNDED (35 days /
+        # 1,000 rows) while the anchor was resolved UNBOUNDED at ingest, so
+        # whenever the anchor-establishing observation falls outside the bounds
+        # — or was another account's, since the anchor group excludes the
+        # account deliberately — a raw filter keeps nothing at all and
+        # `build_blocks(()) == ()` raises `SourceResourceNotFound`. The line
+        # below is already anchor-vs-anchor (`QuotaBlock.resets_at` is the
+        # anchor), so both sides now agree.
+        and observation.canonical_resets_at == reset_at
     )
     block = next(
         (item for item in build_blocks(matching_observations) if item.resets_at == reset_at),
@@ -6386,6 +6401,13 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
         connections, no sync/migration writes from the assembly; the multi-read
         assembly runs inside one transaction per DB. 400 malformed key/source;
         404 ``{code: "unknown_key", reason}`` for keys that don't resolve.
+
+        ``?account=<account_key|unattributed>`` (#416, Codex only) focuses the
+        cycle on one account: its own crossings, its own spend. ABSENT is the
+        shipped merged response and is byte-identical — the client sends the
+        qualifier only under account focus, exactly as `/api/source/` does. The
+        vendor-wide ``*`` sentinel is rejected here (unlike `/api/source/`,
+        where it labels an alert row): it names no cycle to render.
         """
         import re as _re
         import urllib.parse as _urlparse
@@ -6401,6 +6423,23 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
             self._send_milestones_json(400, {"error": "invalid source"})
             return
         key = _urlparse.unquote(raw_key)
+        raw_account = _urlparse.parse_qs(
+            _urlparse.urlsplit(self.path).query, keep_blank_values=True,
+        ).get("account")
+        account_key = None
+        if raw_account is not None:
+            if (
+                len(raw_account) != 1
+                or not _re.fullmatch(r"[0-9a-f]{32}|unattributed", raw_account[0])
+            ):
+                self._send_milestones_json(400, {"error": "invalid account"})
+                return
+            if source != "codex":
+                # Claude weeks are not account-partitioned on this route yet;
+                # accepting the qualifier silently would be a privacy lie.
+                self._send_milestones_json(400, {"error": "invalid account"})
+                return
+            account_key = raw_account[0]
         c = sys.modules["cctally"]
         try:
             if source == "claude":
@@ -6458,12 +6497,17 @@ class DashboardHTTPHandler(BaseHTTPRequestHandler):
                 # fall through to `cyc.reset > now_utc`, which marks every
                 # future-ending cycle current — so one cycle key described two
                 # different cycles depending on which route answered.
+                # #416 QA sweep: the live boundary must belong to the SAME
+                # account the enumeration below is scoped to, or the focused
+                # account's own current cycle is judged against a sibling's
+                # reset and never resolves as current.
                 identity = resolve_codex_cycle_detail_identity(
                     cache_conn, source_root_keys=roots, now_utc=now_utc,
+                    account_key=account_key,
                 )
                 result = c.build_codex_cycle_detail(
                     stats_conn, cache_conn, identity=identity, key=key,
-                    speed=speed, now_utc=now_utc,
+                    speed=speed, now_utc=now_utc, account_key=account_key,
                 )
                 stats_conn.commit()
                 cache_conn.commit()

package/bin/_cctally_dashboard_conversation.py

@@ -442,22 +442,31 @@ def _parse_search_kind_impl(handler, q, valid=_CONV_SEARCH_KINDS):
     return kind
 
 def _run_conversation_query_impl(handler, kernel_call, log_label):
-    """Open cache.db, run ``kernel_call(conn)``, close — with the uniform
-    500 envelopes the three conversation routes share (#151).
+    """Open conversations.db, run ``kernel_call(conn)``, close.
 
-    Collapses the triplicated open-cache → try/except/finally → 500
+    Collapses the triplicated open-store → try/except/finally → 500
     scaffold to one site. Returns ``(ok, body)``: ``ok=False`` means a 500
     has ALREADY been sent and the caller must just ``return``; ``ok=True``
     carries the kernel result (which may itself be ``None`` — the reader's
     404 sentinel — so the explicit flag, not ``body is None``, signals
-    failure). An ``open_conversations_db`` failure is a ``cache unavailable:`` 500;
-    a kernel exception is logged as ``<log_label> failed: %r`` and returned
-    as a ``{type}: {msg}`` 500 — byte-identical to the inlined handlers.
+    failure). An ``open_conversations_db`` failure is logged in full but
+    returned through one privacy-safe transcript-store envelope. A kernel
+    exception is logged as ``<log_label> failed: %r`` and returned as a
+    ``{type}: {msg}`` 500.
     """
     try:
         conn = sys.modules["_cctally_dashboard"].open_conversations_db()
     except (sqlite3.DatabaseError, OSError) as exc:
-        handler._respond_json(500, {"error": f"cache unavailable: {exc}"})
+        handler.log_error("%s transcript store open failed: %r", log_label, exc)
+        handler._respond_json(
+            500,
+            {
+                "error": (
+                    "transcript store unavailable; "
+                    "run cctally doctor for details"
+                )
+            },
+        )
         return False, None
     try:
         body = kernel_call(conn)

package/bin/_cctally_dashboard_envelope.py

@@ -845,6 +845,18 @@ def _sync_failure_envelope(
             "action": "cctally db repair --db stats --yes",
         }
 
+    # conversations.db is intentionally outside core dashboard generations.
+    # Typed transcript ownership therefore degrades through the generic server
+    # contract: Doctor owns integrity diagnosis, and raw SQLite wording must
+    # never manufacture a cache.db repair action for this third store.
+    if attributed("conversations"):
+        return {
+            "kind": "server_sync",
+            "label": "⚠ server sync error",
+            "detail": "The server could not complete its background sync.",
+            "action": None,
+        }
+
     text = error.casefold()
     if (
         "stale maintenance marker" in text

package/bin/_cctally_dashboard_share.py

@@ -41,7 +41,7 @@ import sqlite3
 import sys
 from collections.abc import Mapping
 from dataclasses import replace
-from types import SimpleNamespace
+from types import MappingProxyType, SimpleNamespace
 from zoneinfo import ZoneInfo
 
 from _cctally_core import open_db, parse_iso_datetime
@@ -1317,7 +1317,7 @@ def _share_account_display_label(source: str, account: "str | None",
         conn = c._load_sibling("_cctally_core").open_db()
         try:
             reg = _cctally_account.load_accounts(conn, source)
-            label = _cctally_account.account_label(conn, account)
+            label = _cctally_account.display_account_label(conn, account)
         finally:
             conn.close()
     except Exception:
@@ -1710,9 +1710,50 @@ def _share_digest_input(*, panel: str, template_id: str, source: str,
     }
 
 
+_CODEX_ACCOUNT_SCOPED_DOMAINS = (
+    "periods", "sessions", "projects", "cache_report", "budget", "quota",
+    "alerts",
+)
+
+
+def _share_scope_codex_state(state, account: "str | None"):
+    """Restrict a Codex source state to ONE account's child (#416 §5.6, F16).
+
+    The share handler has always parsed `account` and stamped it on the digest,
+    the response and the history metadata — but never passed it to the snapshot
+    builder, so a focused user exported an ALL-ACCOUNT body LABELLED with the
+    focused account. That is a disclosure defect, not a missing feature, and it
+    is worse than an unlabelled export because the label asserts a scope the
+    body does not have.
+
+    Substitutes the per-account children the source already publishes, so the
+    share reads exactly what the focused dashboard reads — one read model, not a
+    second re-derivation that could drift from it.
+
+    FAILS CLOSED. A decorated source that does not know this account raises
+    rather than falling back to the merged body: falling back is precisely the
+    leak. An UNDECORATED source (<=1 real account) publishes no children and
+    needs none — its merged body IS that account's body.
+    """
+    if account is None:
+        return state
+    data = state.data if isinstance(state.data, Mapping) else {}
+    scopes = data.get("account_scopes")
+    if not isinstance(scopes, Mapping):
+        return state
+    scope = scopes.get(account)
+    if not isinstance(scope, Mapping):
+        raise ValueError("source capability unavailable")
+    scoped = {
+        key: scope[key] for key in _CODEX_ACCOUNT_SCOPED_DOMAINS if key in scope
+    }
+    return replace(state, data=MappingProxyType({**dict(data), **scoped}))
+
+
 def _share_build_source_snapshots(*, ls, template, template_id: str,
                                   panel: str, options: dict, source: str,
-                                  source_explicit: bool, data_snap):
+                                  source_explicit: bool, data_snap,
+                                  account: "str | None" = None):
     """Branch by provider before invoking any provider-specific builder."""
     claude_snapshot = None
     claude_state = None
@@ -1744,8 +1785,11 @@ def _share_build_source_snapshots(*, ls, template, template_id: str,
     codex_snapshot = None
     codex_state = None
     if source in ("codex", "all"):
-        codex_state = _share_codex_state_for_period(
-            data_snap, panel=panel, options=options,
+        codex_state = _share_scope_codex_state(
+            _share_codex_state_for_period(
+                data_snap, panel=panel, options=options,
+            ),
+            account,
         )
         codex_snapshot = _build_codex_source_share_snapshot(
             ls,
@@ -1964,6 +2008,9 @@ def _handle_share_render_post_impl(handler) -> None:
             source=source,
             source_explicit=source_explicit,
             data_snap=data_snap,
+            # #416 §5.6: the captured account has always reached the digest and
+            # the response label; it must reach the BODY too.
+            account=account,
         )
     except _SharePeriodError as exc:
         handler._respond_json(400, exc.payload)
@@ -2153,6 +2200,11 @@ def _handle_share_compose_post_impl(handler) -> None:
                 {"source": snap_recipe["source"]}
                 if "source" in snap_recipe else {}
             )
+            # #416 §5.6: a section that captured an account must be BODY-scoped
+            # to it, exactly as the render path is. Absent (every section the
+            # shipped composer posts today) → account-agnostic and byte-stable;
+            # malformed → the same fail-closed rejection as `source`.
+            section_account = _share_account_selection(snap_recipe)
         except ValueError:
             handler._respond_json(400, {
                 "code": "source_capability_unavailable",
@@ -2204,6 +2256,7 @@ def _handle_share_compose_post_impl(handler) -> None:
                 source=source,
                 source_explicit=source_explicit,
                 data_snap=data_snap,
+                account=section_account,
             )
         except _SharePeriodError as exc:
             handler._respond_json(400, {